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GUILTY UNTIL PROVEN INNOCENT? 

A STUDY OF THE PROPRIETY AND 
LEGAL AUTHORITY FOR THE JUSTICE 
DEPARTMENT’S OPERATION CHOKE POINT 


THURSDAY, JULY 17, 2014 

House of Representatives, 

Subcommittee on Regulatory Reform, 
Commercial and Antitrust Law 

Committee on the Judiciary, 
Washington, DC. 


The Subcommittee met, pursuant to call, at 9:34 a.m., in room 
2141, Rayburn House Office Building, the Honorable Spencer Bach- 
us (Chairman of the Subcommittee) presiding. 

Present: Representatives Bachus, Goodlatte, Issa, Marino, Hold- 
ing, Collins, Smith of Missouri, Johnson, Garcia, and Jeffries. 

Staff Present: (Majority) Daniel Huff, Majority Counsel; Ashley 
Lewis, Clerk; Justin Sok, Legislative Assistant to Rep. Smith of 
Missouri; Philip Swartzfager, Legislative Director to Rep. Bachus; 
Jaclyn Louis, Legislative Director to Rep. Marino; Ellen Dargie, 
Legislative Assistant to Rep. Issa; Jon Nabavi, Legislative Director 
to Rep. Holding; (Minority) Slade Bond, Counsel; and Veronica 
Eligan, Professional Staff Member. 

Mr. Bachus. Good morning. The Subcommittee on Regulatory 
Reform, Commercial and Antitrust Law hearing will come to order. 

Without objection, the Chair is authorized to declare recesses of 
the Committee at any time. 

I am going to recognize myself for an opening statement. 

Let me welcome everyone to today’s oversight hearing on the 
Justice Department’s Operation Choke Point program. 

This Subcommittee has the duty of overseeing the Civil Division 
of the Justice Department, and today’s hearing is part of fulfilling 
that important function. 

By way of introduction, I approach this issue as not just a Sub- 
committee Chair on the Judiciary Committee, but as Chairman 
emeritus and former Chairman of the Financial Services Com- 
mittee. 

So this is a matter I have been following closely across both Com- 
mittees for some time, as have Members on both sides of the aisle, 
including Congress Blaine Luetkemeyer from Missouri, who has 
done a lot of work and study on this program. 

( 1 ) 
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The intent of Operation Choke Point may have carried a purpose 
that we would all agree with, and that is to prevent financial 
fraud. However, my continued concern is that the program threat- 
ens to dry up legitimate sources of credit and financing. 

Those left on the short end can often be the people who have the 
greatest difficulty in getting any credit at all. The program also can 
deny legitimate merchants access to financial networks they need 
to survive. 

In this economy, the last thing we need is to make it harder for 
businesses to operate and employ workers, and by that I mean le- 
gitimate businesses. 

Merchants that have been targeted by Operation Choke Point 
have not uniformly been called predatory lenders, as one might 
have presumed, but are a wide range of businesses, including coin 
dealers, firearms merchants, home-based charities, fireworks sell- 
ers, and even online dating services. That is a wide — very wide net. 
And one thing it immediately suggests is agency overreach. 

To date, the Justice Department has served more than 50 admin- 
istrative and investigative subpoenas on banks. Subpoenas are very 
expensive to comply with and can bring unwanted scrutiny. 

So the natural reaction of a financial institution might be simply 
to sever a connection with a particular merchant and be done with 
it. 

By forcing that kind of decision, a government agency is able to 
achieve a particular policy goal without touching the ball, to use a 
sports term. It strikes me that someone’s due process rights are 
likely being violated. 

We have heard the Department of Justice and the relevant bank 
regulators say that the goal of Operation Choke Point is not to 
eliminate businesses that might — that some might deem politically 
problematic. 

However, after reviewing this issue, I am concerned that internal 
DoJ documents have revealed that, at a minimum, there have been 
an indifference to the risks that this policy poses to legitimate and 
lawful commerce. 

Our witness today — in fact, we have a memo from Assistant At- 
torney General Delery that acknowledges — and let me quote from 
that — “the possibility that banks may stop doing business with le- 
gitimate lenders,” but concluded — and I will quote again — “that 
solving that problem, if it exists, should be left to legitimate lend- 
ers themselves who can present sufficient information to banks to 
convince them that they are wholly legitimate.” 

That sounds like guilty until proven innocent. 

Again, this is a program that I have followed with increasing 
concern. Last August I wrote Attorney General Eric Holder and 
FDIC Marty Gruenberg, asking both agencies to immediately stop 
any actions designed to pressure banks and payment processors to 
terminate business relationships with lawful lenders. 

The fact that we are holding this hearing shows that there are 
many serious concerns that have yet to be satisfactorily addressed. 

With that, let me again thank our witness for appearing today. 

And let me yield to the Ranking Member for his opening state- 
ment. 

Mr. Johnson. Thank you, Mr. Chairman. 
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Ordinary people, mostly minorities, mostly African-Americans, 
are being squeezed every day by the justice system. 

They are sometimes prosecuted on shoddy evidence. They are co- 
erced to accept unfair and unjustified plea bargains offered by pros- 
ecutors with unchecked and unbridled discretion. 

And they are punished if they don’t accept the plea and go to 
trial and get found guilty. They are threatened by these vindictive 
mandatory minimums, additional charges, and enhanced consecu- 
tive counts. So they plead guilty and still get a steep sentence. 

They are serving these steep sentences in overcrowded prisons in 
a country with the largest known prison population in the world. 
And, for many, an incarceration practically becomes a life sentence 
due to the shortage of second chances for criminal offenders. 

This is the state of our criminal justice system as it applies to 
ordinary folks, usually those from communities of color and without 
means. It is a system known as the new Jim Crow. 

In the 4 years since Dodd-Frank, not one single person who fa- 
cilitated or contributed to the greatest financial crisis since the 
Great Depression has been prosecuted. Not one person has been 
held accountable for this immeasurable hardship through a public 
trial in the criminal justice system. 

Not one person has served as an example to those who would 
prey upon vulnerable members of society, including low-income mi- 
norities and the elderly, targeted with predatory loans which were 
then packaged and sold on Wall Street. And when they became 
nonperforming loans, these securities became worthless. Thus, the 
crash back in 2007. 

And all of this taking place at a time when the United States Su- 
preme Court, our activist Supreme Court, is bestowing corpora- 
tions, rewarding corporations, with the rights that people have. 
Citizens United. The First Amendment right to freedom of speech 
has been conferred upon corporations. 

And now with the Hobby Lobby decision, we have corporations 
with a religious right, a First Amendment right to freedom of reli- 
gion to practice their religion. 

But I know of no corporation that has gone to church and paid 
tithes, listened to the sermon, and went out and acted like a Chris- 
tian. 

I know of no corporation that has ever been to jail for operations 
on Wall Street or for — or Main Street. No corporation has ever 
been placed in jail. But, yet, they have the same rights that we 
have. 

Earlier this week the Department of Justice announced a settle- 
ment with Citigroup based on its misrepresentations about the in- 
herent risks of sub-prime mortgages and other egregious behavior. 

This settlement includes a $4-billion penalty under the Financial 
Institutions Reform, Recovery and Enforcement Act, also known as 
FIRREA, F-I-R-R-E-A. Passed in the wake of the savings and loan 
crisis in the 1980’s, FIRREA is a critical tool in uncovering and 
prosecuting illegal conduct. 

In today’s oversight hearing, this Subcommittee will consider the 
propriety and legality, the propriety and legality, of Operation 
Choke Point, which is the formal name for a series of investigations 
by the Justice Department’s Civil Division under FIRREA of banks 
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that knowingly facilitate fraud that, in turn, affects the banks 
through unauthorized debits of consumers’ accounts and other ille- 
gal activity. 

Some of my Republican colleagues have disparaged these inves- 
tigations under the theory that they enable the party in power to 
destroy businesses it favors without proof of wrongdoing. 

But let’s review the facts. The Justice Department has filed just 
one complaint against a financial institution as a result of Oper- 
ation Choke Point. One. 

In this lawsuit, the Justice Department alleged that Four Oaks 
Bank knowingly provided direct access to the financial system to 
parties engaged in defrauding consumers and illegal activities, 
such as a Ponzi scheme, illegal online gaming, and unlawful lend- 
ing. 

This bank not only permitted unlawful actors to directly access 
the financial system, it is alleged, it is also alleged that this bank 
allowed these parties to remove funds directly from consumers’ ac- 
counts even after receiving thousands of complaints from con- 
sumers that these debits were unauthorized. 

In fact, at one point, the bank stopped keeping track of consumer 
complaints altogether, illustrating its willingness to overlook fraud- 
ulent activity. In return for knowingly facilitating fraud, this bank 
received $850,000 in gross fees from a third-party processor. 

Again, this is the only civil complaint filed by the Justice Depart- 
ment, and it was settled within days without going to trial and 
without any prosecution — criminal prosecution for actual fraud. 

Instead of thanking the Justice Department for protecting untold 
consumers and the broader financial system from fraud, my Repub- 
lican colleagues have hurled unfounded accusations, accusing pub- 
lic servants of abusing their power to destroy businesses that they 
simply dislike. 

Although I am dumbfounded by this argument, one thing re- 
mains clear to me. For House Republicans, banks are still too big 
for regulations, too big for trial, too big to fail, to big for jail, too 
big to even investigate for fraud and money laundering, and too big 
to be held accountable for defrauding Americans. 

I thank the Justice Department for fighting on behalf of con- 
sumers, and I encourage you to continue its investigations. 

And I yield back. 

Mr. Bachus. Thank you, Mr. Johnson. 

At this time I recognize the Chairman of the full Committee, Mr. 
Goodlatte, for his opening statement. 

Mr. Goodlatte. Mr. Chairman, thank you very much, and thank 
you for holding this hearing. 

There is no dispute that consumer fraud is a real phenomenon. 
Approximately 10.8 percent of American adults fell victim to it in 
2011. The Department of Justice should enforce the law vigorously 
on the villains who prey on our most vulnerable. 

There is also no dispute that Operation Choke Point is cutting 
off some fraudster access to the banking system. The bipartisan 
concern is that there is an unacceptable level of collateral damage. 

On this point, there appears to be a disconnect between state- 
ments from top officials and what is happening in practice. The of- 
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ficial line is that Operation Choke Point is targeting fraudsters, not 
the whole industry. 

But the Committee has received numerous reports of banks sev- 
ering relationships with law-abiding customers from legitimate in- 
dustries that the Administration has designated “high risk.” 

For example, the Committee obtained a jarring account of a 
meeting between a senior FDIC regulator and a banker contem- 
plating serving a payday lending client. 

The official told the banker, “I don’t like this product and I don’t 
believe it has anyplace in our financial system. Your decision to 
move forward will result in an immediate unplanned audit of your 
entire bank.” 

This sounds more like strong-arming than law enforcement. It is 
naive to answer that the government is merely requiring banks to 
pay heightened attention to these clients, not disallowing them. 
That is not how the system works in practice. 

Banks are highly regulated entities. They are at the mercy of 
their regulators, and that makes them risk-averse. To banks, high- 
risk merchants often are simply not worth the heightened scrutiny. 

This thinking is so prevalent in the industry that it has been 
given a name: De-risking. The chairman of the Office of the Comp- 
troller of the Currency lamented in a recent speech, “And whether 
or not DoJ intended it, it now seems clear that de-risking is occur- 
ring and wiping out legitimate business.” 

The Department of Justice can no longer claim this consequence 
is unintended. It allows Choke Point to continue without changes. 

I also question the Justice Department’s legal authority to pur- 
sue this dangerously overbroad program. The Financial Institutions 
Reform, Recovery and Enforcement Act is one of the few statutes 
that gives the Department authority to issue administrative, inves- 
tigative subpoenas in the civil context. 

Congress granted this authority in the wake of the savings and 
loan scandal to prevent fraud against banks. It applies to fraud af- 
fecting a Federally insured financial institution. Consumer fraud 
was not the focus. 

Nevertheless, the Department of Justice relies on a recent dis- 
trict court case interpreting “affecting” broadly. In that case, 
though, the bank was perpetrating the fraud. 

The district court, moreover, was careful to mention that the ef- 
fects must be sufficiently direct and that there might come a point 
at which the effects on the bank are too attenuated. 

Such is the case with Operation Choke Point. It targets banks 
neither as victims nor as perpetrators. Instead, it is manipulating 
banks whose payment processor clients have merchant clients who 
may or may not defraud their customers. 

Accepting DoJ’s legal authority requires one to believe that by 
“affecting” Congress meant to include fraud that was perpetrated 
not on banks and not even on their customers, but on the cus- 
tomers of their customers’ customers. 

Similarly, the reputational risk is not analogous. In the Depart- 
ment of Justice’s precedent, the bank was accused of cheating its 
own customers, which obviously drives away customers who do not 
want to be their own bank’s next victim. 



6 


By contrast, direct customers of banks targeted by Choke Point 
have no such concerns. Their bank is not defrauding them. The al- 
leged problem is far removed from them and lies with the cus- 
tomers of their bank’s clients’ clients. In this setting, the prospect 
for reputational risk is highly attenuated, and DoJ’s interpretation 
again appears highly strained. 

Many of the concerns I have shared are bipartisan. A Democratic 
colleague told the Administration he wants to be sure we do not 
throw out the baby with the bathwater by shuttering lawful busi- 
nesses. On March 27, 2013, 11 Democrats and 12 Republicans 
wrote banking regulators expressing a similar concern. 

Good law enforcement is hard work and time-consuming. There 
are no shortcuts. Officers have to do the difficult work of identi- 
fying bad actors individually. They simply cannot profile entire in- 
dustries. 

I welcome Assistant Attorney General Delery, and I want to 
know what he makes of the devastating collateral damage to which 
some of our other participants will bear witness. 

I also welcome all of our other witnesses and look forward to the 
discussion. 

Thank you, Mr. Chairman. 

Mr. Bachus. Thank you. 

Before I introduce Assistant Attorney General Delery — it is 
“Delery?” 

Mr. Delery. “Delery,” Mr. Chairman. 

Mr. Bachus. “Delery.” “Delery.” Okay. There are some different 
pronunciations. They did a phonetic thing which I don’t think is 
quite on it. 

But before I make a formal introduction, I want to make two 
submissions for the record. 

First, I ask unanimous consent to place in the record written tes- 
timony from Dr. Douglas Merrill, a Princeton Ph.D. and former 
Chief Information Officer for Google. 

Mr. Bachus. Google is a singing corporation, aren’t they? Isn’t 
that what they are? Maybe that is iTunes. They are not a singing 
corporation, are they? I guess not. 

Mr. Johnson. Singing corporation? 

Mr. Bachus. You mentioned singing corporations. But anyway. 

He specializes in applying radical innovation to solve hard prob- 
lems, including the problem of credit access for the under bank. 

He founded ZestFinance to use Google-style big-data math to pro- 
vide credit to make smarter loans to under-served populations at 
lower rates. 

His algorithm has enabled ZestFinance to slash default rates by 
half and offer up to 50 percent savings for borrowers. Then Oper- 
ation Choke Point nearly destroyed his business. 

He concludes that — and I quote — “More than 100,000 under- 
banked Americans overpaid tens of millions of dollars in fees be- 
cause both ZestFinance and its partner, Spotloan, were limited by 
Choke Point.” 

Also like to submit for the record former FDIC Chairman Bill 
Isaac’s letter. I ask unanimous consent to place in the record a let- 
ter from Bill Isaac, former Chairman of the FDIC, to the youngest 
member of the FDIC’s board of directors in history — no. He is the 
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youngest member of the FDIC’s board of directors in history, ap- 
pointed by President Carter. 

He explains that the Bank Secrecy Act and anti-money laun- 
dering provisions are — and again I quote — “are not intended to im- 
pose a duty on banks to ensure that their business customers are 
complying with every law in every State or that the businesses are 
treating customers fairly and delivering good value.” 

He also writes that, “Operation Choke Point is one of the most 
dangerous programs I have experienced in my 45 years of service 
as a bank regulator, bank attorney, consultant, and bank board 
member.” 

Is there any objection to this submission? Hearing none. 

[The information referred to follows:] 



8 


Statement of 
Douglas Merrill, Ph.D. 

Founder/CEO, ZestFinance 

Previous Chief Information Officer and Vice President of Engineering, Google 


My name is Douglas Merrill, and I have been working on math and computer science 
problems in government and industry for more than 20 years. After completing my 
Ph.D. at Princeton, I became an Information Scientist at the RAND Corporation, a 
think tank focused on public policy. While there, I studied a variety of different 
topics ranging from military team development through to educational reform. 
RAND’s view is that asking the right question can change the world, but that people 
often focus on the wrong point. After leaving RAND, I spent a few years at Price 
Waterhouse before moving to Charles Schwab as Senior Vice President of Common 
Infrastructure and Human Resources Strategy and Operations. Most recently, I was 
Chief Information Officer and Vice President of Engineering at Google. At Google, I 
was responsible for a large variety of tasks, including all internal technology; I also 
ran Google's innovative Initial Public Offering in 2004. My entire career has been 
driven by applying radical innovation to solve hard problems, including the problem 
of credit access for the underbanked. 

In August of 2013, Federal agencies, including both the FDIC and Department of 
Justice, without discussion or public announcement, launched "Operation Choke 
Point”. According to Michael Benardo of the FDIC, in a presentation to the FFIEC on 
September 17, 2013 1 , Choke Point was designed to block illegal uses of the ACH 
network. However, it also targeted companies that are "Legitimate?” (sic), which 
includes domains as varied as ammunition sales, escort services, and "Pay Day 
Loans” (sic). At the same event, Joel Sweet from the DoJ commented on the 
"collateral benefits" of stopping “internet Payday lending”. 

This amounts to blocking ACH usage by companies providing goods and services 
that the regulators did not approve of. ZestFinance was part of that collateral 
damage, even though our product was markedly better than alternatives — and legal 
in every state in which we offered the product. Operation Choke Point has resulted 
in almost half of my employees losing well-paying jobs with benefits. Regulation is 
critical for avoiding market failures and protecting customers; however, secret 
regulation that impacts legal businesses is inappropriate. 

Overview 

After leaving Google in 2008, 1 founded ZestFinance, with the goal of saving the 
underbanked billions of dollars by providing access to fair, transparent, and lower- 
cost credit. I got interested in this problem for a personal reason: My sister-in-law 
needed a new set of tires. 


1 Available at http://www.cvent.com/events/ffiec-information-technology- 
conference/agenda-d4978abdf4L 1495996349c 16dc 2flle3.aspx 



9 


Most of the people reading this testimony wouldn’t blink an eye over buying a new 
set of tires. Even if we didn't have enough cash in a bank account to cover the cost, 
we could use a credit card to fund the purchase. But millions of Americans do not 
have access to even $300 in credit from a bank 2 , and millions more would struggle 
to raise $2,000 on a month's notice from savings, credit, family and friends 3 . My 
sister-in-law, a single mother of three working her way through school with no 
other support, is one of the 25% Americans in this group. 

She called me and we talked about her need for tires. Of course, I gave her the 
money to buy them. I was interested, though, in what her backup plan was - if I, say, 
had not answered my phone? She told me that she would just have taken out 
another payday loan. At the time, I didn't know what a payday loan was. I didn't 
know that there were approximately 25,000 payday loan stores in the US, which is 
more than Starbucks and McDonalds combined or that 10 million American 
households took out a payday loan in the past year 4 , paying an aggregate of $7B in 
fees 5 . 1 know now that payday loans and other products from the "alternative 
financial system" are a key element of how millions of Americans make ends meet 
while waiting for the next paycheck to arrive. 

Coming out of the call with my sister-in-law, I decided to ask the question that I had 
been taught at RAND — not "how do I eliminate high cost credit?" — but "how do I 
create a framework that allows innovation to transform the credit markets, thus 
lowering costs and increasing availability?". After learning more about the product, 

I concluded that there were real problems with how payday loans were designed: 

• First, the loans were expensive in ways that are not captured solely by the 
stated rate. Payday loans typically charge at least $20-$25 for each $100 
borrowed. Although $20 per $100 may not seem like a lot, the out-of-pocket 
cost can be extremely high if, as is usually the case, the borrower uses one 
payday loan to pay another or pays down only the interest. The median 
payday borrower pays almost $500 in fees. 6 At the extreme, the costs can be 
even higher. The top 10% of borrowers pay $1,000 in fees to borrow $350 7 . 


2 Bhutta, Skiba, and Tobacman, 2012. "Payday Loan Choices and Consequences." 
Vanderbily Law and Economics Research Paper 12-30. 

3 Lusardi, Schneider and Tufano, 2011. "Financially Fragile Households: Evidence 
and Implications." Brooking Papers on Economic Activity 2011.1. 

4 Skiba and Tobacman, 2011. "Do Payday Loans Cause Bankruptcy”. Available at 
http://ssrn.com/abstract=1266215 

5 The Pew Charitable Trusts, 2012. "Payday Lending in America: Who Borrows, 
Where They Borrow, and Why”. 

6 The Pew Charitable Trusts, 2013. "Payday Lending in America: Report 2. How 
Borrowers Choose and Repay Payday Loans". 

7 Melzer, 2011. “The Real Costs of Credit Access: Evidence from the Payday Lending 
Market”. The Quarterly Journal of Economics, 126.1. 
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• Second, they are effectively revolving lines of credit. Although the terms of a 
typical payday loan require the borrower to pay back the loan in a couple of 
weeks, this rarely happens. Most borrowers actually require several 
"different loans" in sequence to cover their debt needs, paying the fees over 
and over again without reducing the principal at all. This unfair structure 
results in a paralyzing balloon payment coming due at the end of a long 
sequence of payments. 

• Third, the loans are opaque. Borrowers do not know how long it will take to 
pay off their loans and usually underestimate how long they will be in debt. 

These three factors together - high fees, balloon payments, and unknown payment 
duration - cause second order problems for borrowers: Habitual borrowers have an 
increased risk of bankruptcy largely because so much of their income is devoted to 
paying payday fees. Borrowers do need access to credit that does not create 
additional financial uncertainty, but current payday products are not that. 

Payday loans are so expensive not because lenders collude, or are generally evil, but 
rather because of high loss rates. This part of the math is not that complicated. 
Estimates vary, but about 50% of loans ultimately default 8 , and as many 22% never 
make a single payment 9 . Rational lenders must charge fees that cover their losses, 
and, as a result, payday fees are very high. This burden falls disproportionately on 
people who pay back their loans, since, by definition, those that default do not pay 
the entire loan and the high fees. This "cross-subsidization” is another unfair aspect 
of the current payday loan market. 

This problem, however, has a solution: Transform underwriting. Traditional 
underwriting relies on a simple equation that consumes a relatively small amount of 
data (as little as 50 pieces of information per application). This math has remained 
largely unchanged for decades. However, math and computer science have come a 
long way in the past few years, driven by places like Google. Google's computers use 
several hundred pieces of information and new math techniques to make web 
search, as we know it, possible. 

ZestFinance applies Google-style math to the problem of underwriting, using tens of 
thousands of independent pieces of information to determine applicants' ability to 
repay and willingness to repay a loan. This approach relies on powerful computers 
executing very complex math, and is sometimes called "big data". 

We at ZestFinance have proven that this approach works. ZestFinance's default 
rates are about half of others' in the industry. Equally importantly, ZestFinance 
offers installment loan products that are much different front payday loans. 
ZestFinance's loans are fully transparent - with no hidden fees - and for a fixed term 


8 Li, Mumford, and Tobias (2012). "A Bayesian analysis of payday loans and their 
regulation”. Journal of Econometrics. 

9 Dobbie and Skiba (2011). “Information Asymmetries in Consumer Credit Markets". 
Vanderbilt University Law School, No. 11G05 
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that is long enough to give the customer a chance to repay with small installments. 
Regardless of the amount a borrower pays, every payment pays down both principal 
and interest. This structure results in far lower fees. Equally importantly, 
borrowers are not confused about how much they will pay. 

Operation Choke Point 

By 2013, ZestFinance was making loans directly to customers, in order to gain more 
data to improve our underwriting algorithms, the company was also providing 
technology support to unaffiliated lenders, including Spotloan. Together, 
ZestFinance and Spotloan employed 232 people across 17 states, paying millions of 
dollars in salary and benefits. 

Last August, the Department of Justice launched Operation Choke Point. Although 
Operation Choke Point was intended to protect banks and their customers from 
illegal and fraudulent activity, Operation Choke Point also disrupted a number of 
legal businesses, including ZestFinance. 

On August 28, 2013, Spotloan's sole ACH processor announced that, due to 
Operation Choke Point they would no longer process Spotloan payments, neither to 
fund borrowers’ accounts nor to allow borrowers to make payments against their 
loans. They gave Spotloan 24 hours’ notice. Not surprisingly, Spotloan could not 
respond in that timeframe, and, as a result, was unable to process any payments. 
Thousands of borrowers were unable to receive their loan funds and thousands 
more were cast in default through no fault of their own. 

Spotloan was able to find another payment processor after several weeks. Then, on 
April 29, 2014, that alternative large ACH processor stopped processing Spotloan 
payments, as well. 

Also, in the Choke Point period, funders for companies like ZestFinance and 
Spotloan became nervous. Since there had been little public discussion of what 
actions might fall afoul of Choke Point enforcement, the funders are not able to 
determine whether their money would simply vanish at a moment’s notice. As a 
result, many funders simply stopped funding online loans or, even more severe, 
called in their current outstanding funds. Without such money, it became largely 
impossible to grow. 

Although ZestFinance and Spotloan have each been able to stay afloat during this 
period, costs of doing business have spiked. Before Choke Point, an ACH transaction 
cost about $0.25. Today that same transaction costs between $3 and $7. And when a 
company like ZestFinance is even able to find funding to back its loans, the company 
will pay almost 50% more for the same funding it previously had. 

These costs have to be offset somewhere and, sadly, that offset has been achieved 
through large layoffs. ZestFinance was forced to lay off 45% of its staff (about 21 
people] and Spotloan laid off 85 people from its US staff (about 60%]. Zest’s layoffs 
cost the economy $4M per year in salary, and Spotloan's cost many millions more. 



12 


The reality is that the combination of funding loss, higher costs to operate the 
business, and job cuts have hurt the underbanked most of all: More than 100,000 
underbanked Americans overpaid tens of millions of dollars in fees because both 
ZestFinance and Spotloan were limited by Choke Point. 

Choke Point has also slowed down ZestFinance's innovation. This is the opposite of 
desirable public policy: Innovation is the way to improve credit access. Prior to 
Choke Point, the company was improving its underwriting algorithms, lowering 
default rates and cutting prices. In fact, ZestFinance had found a way to lower 
higher-quality borrowers' interest by hundreds of dollars per loan. Since Choke 
Point, an entire team of engineers and product managers has done nothing besides 
try to find and manage stable ACH processors, which means these highly skilled 
individuals are not working on improvements to help borrowers. 

Summary 

I founded ZestFinance to transform how the 60 million underbanked people in this 
country get credit. I wanted to ensure they had access to fair and transparent credit. 
ZestFinance innovated to find a way to offer up to 50% savings for borrowers. 
Equally importantly, both ZestFinance and Spotloan serve a real customer need by 
offering access to fair and transparent credit. 

Illegal acts should be identified and prosecuted. But we should do so in a way that 
minimizes "collateral damage". People's livelihoods are not collateral damage. And 
we should not focus that damage on industries that we simply dislike. 

Payday loans - and even far lower cost replacements like ZestFinance’s installment 
loans - are expensive credit. There are people who find the existence of such credit 
to be evil. I do not agree: The underbanked deserve access to credit. In fact, 
ZestFinance's customers regularly reach out to thank us for giving them a safe 
bridge across their temporary financial crisis. 1 think it is inappropriate to deny 
credit to a large group of people because we - who are not in the situation - think 
the credit is too expensive. If lenders cannot cover their costs, they will not lend. 

Innovation is the only hope for offering lower prices into underserved markets. 

Innovations like those that we at ZestFinance are trying to accomplish. 

We should use the administrative agencies' expertise to make innovations like 
ZestFinance's more welcomed and influential. I welcome a public discussion of how 
we can make credit more readily available to the underbanked, and how that credit 
should be priced. 

I do not believe that Operation Choke Point has advanced that conversation. 
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July 16, 2014 


Subcommittee on Regulatory Reform, Commercial and Antitrust Law, 

Oversight Hearing on: 

“Guilty until Proven Innocent? A Study of the Propriety & Legal Authority for the 
Justice Department’s Operation Choke Point” 

July 1 7, 2034 at 9:30 a.m. 

Subcommittee Chairman: The Honorable Spencer Bachus 
Ranking Member: The Honorable Hank Johnson 

. 1 re 8 ret that I will not be able to attend in person this incredibly important meeting of 
your Subcommittee. In lieu of attending in person. I will send separately written testimony 
expressing my views on Operation Choke Point. 'This testimony is substantially identical to 
the views I expressed under oath at a hearing by the Subcommittee on Financial Institutions 
and Consumer Credit of the House Financial Services Committee on July 15, 2014. 

In addition to sending my previous testimony I would like to address some additional 
very important issues in this letter, pertaining particularly to the Bank Secrecy Act and Anti- 
Money Laundering laws (BSA/AML). The opinions 1 express are my own, and I do not 

t0 speak nn behalf of my firm, FTI Consulting. In the interest of full disclosure, some 
ol I l l's clients have an interest in the matters before die Subcommittee. 

By way of background, I was appointed to the FDIC board of directors at age 34 by 
President Carter in 1978 and was named Chairman by President Reagan in 1981 . T returned to 
the private sector at the end of 1 985 after serving nearly two years beyond my six-year term at 
the I DIC . I also served during my term at the FDIC as Chairman of the Financial institutions 
Examination Council (the coordinating body for the federal regulators of depository 
institutions) and as a. member of the Basel Committee. 

In my view, Operation Choke Point i s one of the most dangerous programs I have 
experienced in my 45 years of service as a bank regulator, bank attorney and consultant, and 
bank board member. I fully support the bill introduced by Representative Luetkemeyer, HR 
4986, to rein in this program. 

Without legal authority and based on a political agenda, unelected officials at the 
Department of Justice (DOJ) are coordinating with some bank regulators to deny essentia! 
banking services to companies engaged in lawful business activities that some government 
officials don t like. Bankers. are being cowed into compliance by an oppressive regulatory 
regime. ■ 

Perfectly lawful businesses are being denied access to essential banking services 
because they offer products or services uneiected government officials do not like. This ought 
to alarm and frighten each of us irrespective of our ideology, party affiliation, or view of the 
particular products or services being cut off. 

Operation Choke Point is a particularly egregious example of an un-Constitutiona! 
abuse ol power. It is driving lawful businesses out of the banking system, denying them not 
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only loans but also deposit accounts, payments processing services, payroll accounts, and 
other services critical to operating any business. 

1 understand that some claim that Operation Choke Point does not impose anv new 
hardens or responsibilities on banks or their customers that banks are already responsible 
for knowing and policing their customers under the BSA/AMT, laws. The most obvious flaw 
m this fallacious assertion is that if it were correct. Operation Choke Point would not be 
needed. 

The BSA/AML law has been around for decades. It began as a law' intended to detect 
tax evasion and organized crime activity, including tracking drug money. It was expanded 
greatly after September 1 1 , 2001 to include detecting flows of money possibly relating to 
terrorist activity. Banks are required to know their customers well enough to detect 
suspicious flows of funds that could signal illegal drug or terrorist activity and to report those 
suspicions funds flows to FinCKN. Banks ore also supposed to detect transactions involving 
persons on the OFAC terrorist list and to reject those transactions. 

If banks are lax in meeting these responsibilities, their regulators can and do impose 
substantial penalties. Examiner's from the banking agencies devote a good deal of attention to 
insuring the banks have proper BSA/AML controls in place and for the most part the industry 
is highly compliant. 

BSA/AML is not intended to impose a duty on banks to ensure that their business 
customers are complying with every law in every state or that the businesses are treating their 
customers fairly and delivering good value. A bank will likely choose not to do business with 
customers who it believes are not treating people fairly or might be violating the law, but that 
is a judgment best left to the management and directors of individual banks to decide. 

The Luetkemeyer bill would not relieve banks of any of their responsibilities under 
BSA/AML or any other iaw or regulation. Moreover, the bill states clearly that banks will 
retain the discretion to refuse to do business with any customer for any reason. 

The indisputable truth is that Operation Choke Point is not about BSA/AML in any 
respect. The 1)0.1 has decided to go after businesses that it and some other government 
agencies do not like — businesses such as nome-based charities, fireworks and firearms 
distributors, short-term lenders, check cashers, pharmaceutical firms, life-time guarantees, 
surveillance equipment firms, and telemarketers. This is being done by the DOJ without any 
statutory authority and in fact in direct contravention of state and federal laws, including the 
Dodd-f rank Act. 

Wc do not have to speculate about the strategy and motives behind Operation Choke 
Point, as they are set forth quite dearly in a September 9, 2013 memo written by Michael 
Blume, Director of the Consumer Protection Branch of the DOl to Stuart Delery, Assistant 
Attorney General in the Civil Division of the DOJ, providing a six-month status report on 
Choke Point. Mr. Blume describes tile strategics in these terms otl page. 1 4 of the report: 

* We principally are pursuing civil, rather than criminal, investigations. 
Criminal investigations can take considerably longer to complete and 
generally require a more intensive investigation. Only if an investigation 
presents particularly egregious criminal conduct are we opening it as a 
criminal investigation. 
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s We are targeting banks more than payment processors, and payment 

processors more than merchants. Any one case, whether against a bank, a 
processor, or a merchant, takes substantial time and attention from cur 
team. Bank cases will deter other banks, thereby stopping the processing of 
transactions for fraudulent merchants and the processors with which they 
work. This may mean filing civil complaints or criminal cases against banks 
based on transactions with fraudulent merchants and/or processors - but not 
fifing actions against the underlying fraudulent merchants or processors. 
This practice is not optimal and may present litigation risks. But it may be 
necessary to prevent the initiative from grinding to a halt due to resources 
used pursuing the merchants and processors. 

These words arc chilling to anyone who has any regard for due process and the rule of 
law. Mr. Blume explains that the DO.T prefers using civil complaints rather than criminal 
complaints because the burden of proof is much lower and requires less investigation into the 
lacts. And he explains that the DOJ is going after the banks who are not violating the law 
instead of the merchants who may be violating the law because the DOJ can do much more 
damage with much less effort by coercing the banks. 

As for the claim by some that the DOJ is actually doing the banks a favor by 
protecting them from potential liability, Mr. Blume puts that notion to rest with the following 
passage from page 11 of his six-month report: 

The financial institutions we are investigating have not suffered any actual 
losses, hut such actual losses are not necessary under FIRREA. There is 
only one case interpreting the phrase "affecting a financial institution” in 
the context of FIRREA, ami that case supports our theory. 

Mr. Blume also addresses on page 1 0 of his report the collateral damage being done to 
lawful businesses that are being denied essential banking services such as deposit accounts, 
check clearing, and payroll processing: 


Although we recognize the possibility that banks may have therefore decided 
to stop doing business with legitimate lenders, we do not believe that such 
decisions should alter our investigative plans. Solving that problem - if it 
exists - should be left to the legitimate lenders themselves who can, through 
their own dealings with banks, present sufficient information to the banks to 
convince them that their business model and lending operations are wholly 
legitimate. 

Contemplate Mr. Blume’ s assumption that in our Constitutional republic a business is 
guilty until it proves itself innocent. There is no allegation of wrong doing by the business 
that can be disproved. The company is simply in a business that, while legal, has been 
determined “undesirable” and therefore “high risk” by the federal bureaucracv. This 
Orwellian resultis lightening. 



16 


FinCEN and the federal banking agencies expect banking organizations that open and 
maintain accounts for money services businesses to apply the requirements of BSA, as they 
do with all accountholders, on a risk-assessed basis. As with any category of account-holder, 
there will be money services businesses that pose little risk of money laundering and those 
that pose a significant risk. It is essential that banking organisations neither define nor treat all 
money services businesses as posing the same level of risk. Operation Choke Point has led to 
blanket terminations of all firms within an industry without regard to the prescribed 
individualized risk assessments that banks have traditionally made with respect to their 
customers. 

The Luetkemeyer bill is an extremely important step in reining in government 
agencies that are greatly overstepping their authority and breaching the Constitutional 
separation of powers among the three branches of government and between the states and 
federal government. While some of us may applaud the attack against payday lending, 
ammunition distributors, or home-based charities, we will likely take a different position 
when a new administration decides to attack activities more near and dear to our hearts. 

Before closing, let me return to the claim some are making that Operation Choke Point 
does not. require banks to do anything they arc nol already required to do under BSA/AML. 
This claim is demonstrably false, as anyone can readily see in reading Mr. Blame’s six-month 
report. Moreover, if Operation Choke Point is not doing anything not already required by 
USA AML, there is no justification whatsoever for the continued operation of Choke Point. 
Nearly all hanks were BSA/AML compliant long before Operation Choke Point was imposed 
by unelected government officials and will remain compliant long after Congress chokes off 
this disgraceful Operation. 

T urge Congress to approve the Luetkemeyer bill without delay* as Operation Choke 
Point is doing severe and irreparable damage to firms engaged in lawful businesses approved 
by Congress and by state legislatures. 
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Mr. Bachus. At this time I would like to introduce our first wit- 
ness, Honorable Stuart Delery. Is that right? Good. 

He was sworn in as Assistant Attorney General for the Civil Di- 
vision on August 5, 2013, following confirmation by the U.S. Sen- 
ate. He has led the division since March 2012. 

As an Assistant Attorney General, he oversees the largest liti- 
gating division in the Department of Justice. Each year the Civil 
Division represents some 200 client agencies in approximately 
50,000 different matters. 

The Civil Division represents the United States in legal chal- 
lenges to Congressional statutes, administrative policies, and Fed- 
eral agency actions. 

He joined the United States Department of Justice in January 
2009 as chief of staff and counsel to the Deputy Attorney General 
and later served as Associate Deputy Attorney General. From Au- 
gust 2010 until March 2012, he served as senior counsel to the At- 
torney General. 

Before joining the Department of Justice, Mr. Delery was a part- 
ner in the Washington, D.C., law firm of WilmerHale, where he 
was a member of the litigation department and the appellate and 
Supreme Court litigation practice group and a vice chair of the 
firm’s securities department. 

He graduated from Yale Law School and the University of Vir- 
ginia. He clerked for Justice Sandra Day O’Connor and Justice 
Byron R. White of the U.S. Supreme Court and for Chief Judge 
Gerald — and how do you pronounce — “Tjoflat”? 

Mr. Delery. “Tjoflat,” Mr. Chairman. 

Mr. Bachus [continuing]. Of the U.S. Court of Appeals for the 
Eleventh Circuit. 

So we welcome your testimony. And you are recognized for that 
purpose. 

TESTIMONY OF THE HONORABLE STUART F. DELERY, ASSIST- 
ANT ATTORNEY GENERAL, CIVIL DIVISION, U.S. DEPART- 
MENT OF JUSTICE 

Mr. Delery. Thank you very much, Chairman Bachus, Ranking 
Member Johnson, and Members of the Subcommittee. Thank you 
for inviting me here today and for providing the Department of 
Justice the opportunity to describe our work designed to protect 
consumers from fraud perpetrated by certain merchants, third- 
party payment processors, and banks. 

The Justice Department has made it a priority to fight consumer 
fraud of all kinds. Fraud against consumers comes in many forms, 
from telemarketing fraud to mortgage fraud, from lottery scams to 
predatory and deceptive online lending, and often strips our most 
vulnerable citizens of their savings and even their homes. 

The Civil Division’s consumer protection branch, along with the 
Criminal Division and the U.S. attorney’s offices across the coun- 
try, has worked for decades to protect the health, safety, and eco- 
nomic security of the American consumer. 

Based on its years of experience in combatting fraudulent mer- 
chants and by following the flow of money from fraudulent trans- 
actions, the Department has learned that some banks and third- 
party payment processors, which are intermediaries between banks 
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and merchants, know that merchants are engaged in fraud and, 
yet, continue to process their transactions, in violation of Federal 
law. 

As a result, in November 2012, our attorneys proposed a con- 
centrated effort to pursue fraud committed by banks and payment 
processors as a complement to other consumer protection work. 

This strategy aims both to hold accountable those banks and 
processors that violate the law and to prevent access to the bank- 
ing system by fraudulent merchants, and this — this effort is some- 
times referred to as Operation Choke Point. 

One of our investigations now has been resolved, as was men- 
tioned earlier, and provides a useful example of our efforts in this 
area. 

In April, a Federal District Court in North Carolina entered a 
consent order and approved a settlement agreed to by the Depart- 
ment and Four Oaks Bank. 

According to our complaint, Four Oaks allowed a third-party pay- 
ment processor to facilitate payments for fraudulent merchants de- 
spite active and specific notice of fraud. 

For example, Four Oaks received hundreds of notices from con- 
sumers’ banks, including statements by account holders submitted 
under penalty of perjury, that the people whose accounts were 
being charged had not authorized debits from their accounts. 

Four Oaks had evidence of efforts by merchants to conceal their 
true identities. Four Oaks also had evidence that more than a 
dozen merchants served by the payment processor had a return 
rate over 30 percent, a strong sign that the bank was facilitating 
repeated fraudulent withdrawals. And, indeed, one merchant had 
a return rate of over 70 percent. 

According to our complaint, despite these and other signals of 
fraud, Four Oaks permitted the third-party payment processor to 
originate approximately $2.4 billion in debit transactions against 
consumers’ bank accounts. 

So as the Four Oaks case demonstrates, the Department’s policy 
is to base its investigations on specific evidence of unlawful con- 
duct. 

Nevertheless, in recent months, we have become aware of reports 
suggesting that these efforts instead represented an attack on busi- 
nesses engaged in lawful activity. And I thank you for the oppor- 
tunity to clear up this misconception. 

Our policy is to investigate specific unlawful conduct based on 
evidence that consumers are being defrauded, not to target whole 
industries or businesses acting lawfully, and to follow the facts 
wherever they lead us in accordance with the law, regardless of the 
type of business involved. 

As with virtually all of our law enforcement work that touches 
on regulated industries, our work in this area includes communica- 
tion with relevant regulatory agencies. Such communication is de- 
signed to ensure that we understand the industry at issue and that 
we have all the information we need to evaluate enforcement op- 
tions in light of the evidence we uncover. That is nothing new. 

So, for example, for many years, banking regulators have warned 
banks about the heightened risks to consumers associated with 
third-party payment processors. 
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In some of that guidance, FDIC has explained that, although 
many clients of payment processors are reputable merchants, an 
increasing number are not and should be considered high risk. And 
the FDIC has provided examples of high-risk merchants for pur- 
poses relevant to its regulatory mission. 

The Department’s mission, however, is to fight fraud. And we 
recognize that an entity simply doing business with a merchant 
considered high risk is not fraud. 

So, in summary, our efforts to protect consumers by pursuing 
fraudulent banking activity are not focused on financial institu- 
tions that merely fail to live up to their regulatory obligations or 
that unwittingly process a transaction for a fraudulent merchant. 

But when a bank either knows or is willfully ignorant to the fact 
that law-breaking merchants are taking money out of consumers’ 
bank accounts without valid authorization and the bank continues 
to allow that to happen, the Department will not hesitate to en- 
force the law. 

So thank you once again for the opportunity to appear before you 
today. And at this time, Mr. Chairman, I would be happy to answer 
any questions that you or the other Members of the Subcommittee 
may have. 

[The prepared statement of Mr. Delery follows:] 
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Statement of Stuart F. Delery 
Assistant Attorney General, Civil Division 
Before the U.S. House of Representatives 
Committee on Judiciary 

Subcommittee on Regulatory Reform, Commercial and Antitrust Law 
July 17, 2014 


Chairman Bachus, Ranking Member Johnson, and Members of the Subcommittee, 
thank you for inviting me here and for providing the Department of Justice the 
opportunity to appear at today’s hearing to describe our work designed to protect 
consumers from fraud perpetrated by certain merchants, third-party payment processors, 
and banks. 

As the Attorney General has said, the Justice Department has made it a priority to 
fight consumer fraud of all kinds and to hold the perpetrators accountable. Consumer 
fraud comes in many forms — from telemarketing fraud to mortgage fraud, from lottery 
scams to predatory and deceptive on-line lending — and often strips our most vulnerable 
citizens of their savings and even their homes. 

While there is seemingly no limit to the kinds of schemes that perpetrators of 
fraud invent, many of these schemes have one thing in common: they employ the banking 
system to take money from their victims. Once a fraudulent merchant can work his way 
into the banking system, he no longer has to convince unwitting consumers to hand over 
cash or mail a check. Instead, with the click of a button, he can debit their bank accounts 
and credit his own, repeatedly, without permission, and in violation of federal law — until 
somebody does something to stop it. 

The Civil Division’s Consumer Protection Branch — along with the Criminal 
Division and United States Attorney’s Offices across the country — has worked for 
decades to protect the health, safety, and economic security of the American consumer. 
Based on its years of experience in combating fraudulent merchants, the Department, 
along with our law enforcement and regulatory partners, recognizes the critical role 
played by a limited number of third-party payment processors — intermediaries between 
banks and merchants — in allowing fraudulent merchants to gain access to our banking 
system and consumers’ bank accounts. In some cases, these payment processors open 
bank accounts in their own names and, for a fee, use these accounts to conduct banking 
activities on behalf of their customers. While some customers are legitimate businesses, 
others are fraudulent merchants who either choose not to open their own bank accounts or 
cannot do so because banks will not do business with them. At the merchants’ direction, 
the processor will initiate debit transactions against consumers’ accounts and transmit the 
money to the fraudulent merchant. 

Guided by the facts and the law, and by following the flow of money from 
fraudulent transactions, the Department has learned that some third-party payment 
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processors know their merchant clients are engaged in fraud and yet continue to process 
their transactions — in violation of federal law. Further, our experience in these cases has 
been that some banks, in violation of the law, either know about the fraud they are 
facilitating or are consciously choosing to look the other way. As a result, in November 
2012, our attorneys proposed a concentrated effort to pursue the fraud committed by the 
banks and payment processors. This strategy aims both to hold accountable those banks 
and processors who violate the law and to prevent access to the banking system by the 
many fraudulent merchants who had come to rely on the conscious assistance of banks 
and processors in facilitating their schemes. This effort is sometimes referenced as 
Operation Chokepoint 

To begin the effort, using a variety of public and nonpublic sources, the 
Consumer Protection Branch assembled evidence of fraudulent activity by specific 
fraudulent merchants, payment processors, and banks. That information included 
statements of cooperating witnesses; tips and referrals from defrauded consumers and 
banks whose customers had been victimized, and evidence obtained during investigations 
of fraudulent merchants that identified third-party payment processors or banks 
participating in the merchants’ unlawful conduct. 

In addition, we obtained information from the Federal Reserve Bank of Atlanta 
concerning banks with abnormally high "return rates” — one possible indicator of 
potential fraud. “Return” or “chargeback” rates refer to the percentage of transactions 
that are reversed. In addition to “unauthorized” returns, which represent an explicit claim 
that a consumer did not authorize a debit in a transaction account, a high rate of “total” 
returns also indicates potential fraud. For example, returns due to insufficient funds may 
reflect consumers who had money taken from their accounts unexpectedly or repeatedly, 
without authorization. Returns due to a closed account may reflect consumers who were 
forced to close their bank accounts as a consequence of unauthorized debits. 

Based on these and other sources, between February and August 2013, the 
Consumer Protection Branch issued civil subpoenas to specific banks, processors, and 
other entities for which the Department had specific evidence suggesting that those 
entities might be engaged in fraud or might have evidence of fraudulent conduct by 
others. We then reviewed the information provided in response to those subpoenas and, 
depending upon the nature of the evidence, we sought additional information, determined 
to pursue a civil or criminal investigation, or closed the file. 

One of those investigations now has been resolved, and its resolution 
demonstrates exactly the type of troubling relationship between a bank and a set of 
perpetrators of fraud that gave rise to the Department’s effort. On April 25, 2014, the 
U S. District Court for the Eastern District of North Carolina entered a consent order and 
approved a settlement agreed to by the Department and Four Oaks Bank. According to 
the Department’s complaint. Four Oaks allowed a third-party payment processor to 
facilitate payments for fraudulent merchants despite active and specific notice of the 
fraud, including: 
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• Four Oaks received hundreds of notices from consumers’ banks — submitted 
under penalty of perjury — that the people whose accounts were being charged had 
not authorized the debits from their accounts. 

• Four Oaks had evidence that more than a dozen merchants served by the payment 
processor had a “return rate” over 30 percent — a strong sign the bank was 
facilitating repeated fraudulent withdrawals. Indeed, one merchant had a return 
rate of over 70 percent. 

• Four Oaks had evidence of efforts by merchants to conceal their true identities. 

According to the Department’s complaint, despite these and many other signals of fraud, 
Four Oaks permitted the third-party payment processor to originate approximately $2.4 
billion in debit transactions against consumers’ bank accounts, for which the bank 
received more than $850,000 in fees. As a result of the bank’s actions, many American 
consumers were defrauded of their hard-earned savings. 

The consent order, agreed to by Four Oaks and approved by the court, requires 
Four Oaks Bank to pay $1 million to the U.S. Treasury as a civil monetary penalty and to 
forfeit $200,000 to the U.S. Postal Inspection Service’s Consumer Fraud Fund. It also 
obligates Four Oaks to take steps to prevent future consumer fraud. 

As the Four Oaks Bank case demonstrates, the Department’s policy is to base its 
investigations on specific evidence of unlawful conduct. Nevertheless, in recent months, 
we have become aware of reports suggesting that these efforts instead represented an 
attack on businesses engaged in lawful activity. I thank you for this opportunity to clear 
up this misconception. Our policy is to investigate specific conduct, based on evidence 
that consumers are being defrauded — not to target whole industries or businesses acting 
lawfully, and to follow the facts wherever they lead us, in accordance with the law, 
regardless of the type of business involved. We think this endeavor demonstrates the 
importance of holding financial institutions accountable when they participate in 
fraudulent activities, just as we hold accountable any other entity that engages in 
unlawful conduct. 

As with virtually all of our law enforcement work that touches upon highly 
regulated industries, our work in this area includes communication with relevant 
regulatory agencies, here including the Federal Deposit Insurance Corporation (FDIC), 
the Office of the Comptroller of the Currency, the Consumer Financial Protection 
Bureau, and the Federal Reserve Board. Such communication is designed to ensure that 
we understand the industry at issue, that our investigations do not unnecessarily or 
improperly frustrate regulatory efforts, and that we have all the information needed to 
evaluate the enforcement options available to address violations that our investigations 
uncover. 


Federal law requires banks to “know their customers” in a variety of ways and to 
report instances of suspicious activity in order to prevent money laundering, consumer 
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fraud, and other illegal behavior. Banks are aware of these laws, and most have instituted 
programs to comply with these longstanding requirements. Indeed, it is because of these 
programs that many fraudulent merchants have difficulty engaging directly with banks 
and have come to rely on third-party payment processors for access to the banking 
system. Noting this trend, the FDIC — as part of its regulatory responsibilities — has 
warned banks about the heightened risks to consumers associated with third-party 
payment processors in its Guidance on Payment Processor Relationships first issued in 
2008, and has explained that, “[although many clients of payment processors are 
reputable merchants, an increasing number are not and should be considered ‘high risk.’” 
The FDIC has provided examples of “high-risk merchants” for purposes relevant to its 
regulatory mission. The Department’s mission is to fight fraud, and we recognize that an 
entity’s simply doing business with a merchant considered “high risk” is not fraud. 

Indeed, we recognize that most of the businesses that use the banking system — 
even those in industries considered “high risk” — are not engaged in fraud, and we are 
dedicated to ensuring that our efforts to combat fraud do not discourage or inhibit the 
lawful conduct of honest merchants. While the Department’s complaint against Four 
Oaks Bank demonstrates that many of the fraudulent merchants for which Four Oaks 
provided access to the banking system were engaged in illegal online short-term lending, 
we follow the facts where they lead us. The Department would only be interested in the 
conduct of an online short-term lender, or any merchant, to the extent that its conduct 
violates the law. 

I thank you for this opportunity to reiterate what I and other Department officials 
have made clear on numerous occasions: that the Department is seeking to protect 
consumers from fraudulent practices in all industries and has no interest in pursuing or 
discouraging businesses engaged in lawful conduct. The Attorney General said this in a 
recent video posted publicly on the Department website. The Department has said this in 
response to Congressional inquiries. And the Department has said this many times to 
industry groups, including in a letter I wrote to the American Bankers Association and 
the Electronic Transaction Association. 

Our efforts to protect consumers by pursuing fraudulent banking activity are not 
focused on financial institutions that merely fail to live up to their regulatory obligations 
or that unwittingly process a transaction for a fraudulent merchant. We are fighting 
fraud. When a bank either knows or is willfully ignorant to the fact that law-breaking 
merchants are taking money out of consumers’ bank accounts without valid 
authorization, and the bank continues to allow that to happen, that is not just a concern 
for bank regulators. That is fraud, and it can result in true devastation for consumers. 
When any entity — whether it is a merchant, a third-party payment processor, or a bank — 
commits fraud against consumers, the Department will not hesitate to enforce the law. 

We will continue to pursue our mission to protect honest, hardworking Americans from 
those who put their financial security in peril. 

Thank you, once again, for the opportunity to appear before you today. At this 
time, Mr. Chairman, 1 would be happy to address any questions you or Members of the 
Subcommittee may have. 
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Mr. Bachus. Thank you very much. 

First question will be Mr. Holding. 

Mr. Holding. Thank you, Mr. Chairman. 

You testified on Tuesday and, at that hearing, the FD — well, 
the — on Tuesday, the FDIC testified that they had authored a 
somewhat notorious high-risk activity list that predicates Oper- 
ation Choke Point scrutiny. 

You know, this is a somewhat dangerous list because it essen- 
tially tells banks that they shouldn’t do business with certain in- 
dustries, irrespective of the fact than an industry is operating en- 
tirely within the law, and most of these industries are legal under 
Federal, State, and local law. Some even have significant First 
Amendment protections. 

So did the Department, the DoJ, conduct a review of whether 
any of these restrictions would violate the First Amendment rights 
of Americans? And, if they did not, why not? 

Mr. Delery. So, Congressman, the list that you are referring to, 
I believe, that was discussed by the FDIC on — at the hearing on 
Tuesday is a list that the FDIC prepared for its purposes. 

As I said then, that was not something that the Department of 
Justice was involved in preparing. And whether a financial institu- 
tion does business with a merchant that is in an industry on that 
list or any other list is not, under our policy, a basis for the inves- 
tigations that we are talking about here. 

Mr. Holding. Does the Department have its own definition of 
high-risk activity that would create liability under Operation 
Choke Point? 

Mr. Delery. Right. So that is not the basis for the policy or the 
actions that we are taking here. 

Mr. Holding. But does the Department have their own defini- 
tion, you know, of what seems to be somewhat of a term of art that 
is developing here? 

Mr. Delery. No. I don’t believe so, Congressman. 

The investigations that we are conducting are based on evidence 
of fraudulent conduct by particular institutions that are based on 
traditional law enforcement activities or investigative techniques. 

So we are investigating institutions based on evidence 

Mr. Holding. So you don’t pay any attention to that definition? 
So you don’t use the FDIC’s definition or list? That doesn’t go into 
your calculus in making a decision — prosecutorial decision, Fourth 
Amendment decision? 

Mr. Delery. We are basing our investigations on evidence that 
we receive from various sources of actual fraudulent activity in a 
particular context. We are not looking at whole industries. 

So the information may come from a referral from a bank whose 
customers have been victimized or complaints from the customers 
themselves or from investigations that we are conducting into 
fraudulent merchants. 

Mr. Holding. Okay. 

Mr. Delery. So it is a standard series of investigative tech- 
niques. 

Mr. Holding. Let’s go to the funding. 

The Department has a working capital fund used to support op- 
erations, and one part of that fund is known as the 3 percent fund 



26 


that allows the Department to, you know, retain 3 percent of af- 
firmative civil recoveries. 

You know, as this is a non-appropriated fund, there are no 
strings attached from Congress on how it is used and it inhibits 
oversight. You know, aside from an occasional question from Con- 
gress, the Department can use the money however it sees fit. 

So, you know, these funds are utilized to hire attorneys, file addi- 
tional enforcement actions. So I am concerned this is unaccountable 
and non-transparent and somewhat of a slush fund. 

So I know you have been asked about this at another hearing. 
So, hopefully, you have had a chance to reflect and can answer it 
now. 

How much money is currently held in the working capital fund? 
And how much money is utilized to hire attorneys? How many FTE 
does this support? And can you provide to the Committee an ac- 
counting for the last 5 years including the unobligated funds held? 

Mr. Delery. So, Congressman, that was a subject that came up 
at the hearing on Tuesday. We are looking into responding to simi- 
lar questions, and we would be happy to take those back as well. 
I don’t have the specific answers on that here today. We could cer- 
tainly get back to the Committee on that. 

You know — and, obviously, the Civil Division is not the only part 
of the Department that the 3 percent fund supports, and it only 
supports small and specified parts of — of the work that we do typi- 
cally related to our affirmative — affirmative enforcement efforts. 

Mr. Holding. Thank you. 

Mr. Chairman, I yield back. 

Mr. Bachus. Thank you. 

I am going to recognize Mr. Collins for a unanimous consent re- 
quest and then the Ranking Member. 

Mr. Collins. Thank you, Mr. Chairman. 

And especially in light of the vote series and other things and 
with other schedules. 

I have a letter here from TSYS, from Mr. Troy Woods, that I 
would like to enter into the record detailing concerns about Oper- 
ation Choke Point, which highlight many of my concerns with this 
amazingly misguided program. 

Mr. Bachus. Hearing no objections, it is introduced. 

[The information referred to follows:] 
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Representative l ollins : 

I am writing* io express I M's concerns regarding (Operation Choke Point, a Department oi 
Justice (Hot i initiative that urge's thud-parts puvmcni processors and their financial instiuitions 
that process pavments tor businesses engaged in higher-risk, hut legal, aemiltes 

I SYS is in a unique position to assess the impact ol' Operation Choke Point \s a leading 
processor of credit card and debit card payments in the I nited States. I SYS deals with a wide 
s ariety ol clients, including financial institutions ol all si/cs. communilv hanks and credit unions, 
small- and mid-si/e businesses, large retailers, governments and millions of consumers IS 1 * s. 
as a third-party payments processor, operates an extensive behind-the-scenes infrastructure that 
facilitates the electronic exchange ol funds between buvers and sellers in a manner that is last, 
accurate, secure and compliant with applicable law - and regulations. 

IS'is stronglv believes that the present regulators environment, which includes the prudential 
hanking agencies, the I ederal I raJe ( ommisxion lllCl as well as the Consumer financial 
Protection Bureau, is sufficient to ensure that financial institutions and third-parts pavmcnt 
processors implement sound risk management and mitigation, responsive fraud prevention and 
detection, and adequate consumer protections I nlortunatclv. Operation Choke Point's broad 
scope has morphed the traditional fraud and risk-mitigation roles ol these providers into law- 
enforcement roles and established a dangerous precedent 

ISVs is e.xircmclv concerned lhai Operation Choke Point gives financial institutions and third- 
parts payment processors the untenable choice of either severing valuable and legal customer 
relationships or risking enforcement actions (w |)o, I and others \s noted ill the Stall' Report on 
Operation Choke Point isstieJ h\ the I s House of Representatives Committee on Oversight 
and tiovemmeni Reform 'Operation Choke Point has torccd hanks to terminate relationships 
with a wide vurielv of cntirclv lawful .ills', legitimate merehanls.” Such actions have a direct 
impact on consumers 
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Mr. Bachus. And the Ranking Member is now recognized. 

Mr. Johnson. Mr. Chairman, I would like to be recognized for 
the — only for the purpose of introducing by unanimous consent for 
the record a letter from Howard Langer, a professor at the law 
school of the University of Pennsylvania and a founding Partner of 
Langer, Grogan & Diver, PC, which describes his work against 
Wachovia Bank, which paid full damages to 750,000 victims of ap- 
proximately 130 mass market frauds. 

And I would also like to tender for the record a letter from the 
Americans for Financial Reform, a coalition of several dozen con- 
sumer and civil rights groups, urging this Subcommittee to sup- 
press efforts to ensure that banks and payment processors avoid fa- 
cilitating illegal activity by complying with long-standing due dili- 
gence requirements to know their customers, monitor return rates, 
and be alert for suspicious activity; and, also, a — the written testi- 
mony of Lauren Saunders, who testified on behalf of the National 
Consumers Law Center in Tuesday’s hearing on the Operation 
Choke Point in the Committee on Financial Services; and last, but 
not least, several guidance documents issued under the Bush Ad- 
ministration on high-risk merchants and payment processors. 

I will tender these for the record. 

Mr. Bachus. Without objection, those materials are entered into 
the record. 

[The information referred to follows:] 
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AMERICANS 

FOR FINANCIAL REFORM 


Americans for Financial Reform 

1629 K St NW. 10th Floor, Washington, OC. 20006 

202.466.1885 


July 16,2014 

The Honorable Spencer Bachus The Honorable Hank Johnson 

Uniled States House of Representatives United States House of Representatives 

2246 Rayburn Building 2240 Rayburn HOB 

Washington. DC 20515 Washington, DC 20515 

Re Support Operation Choke Point and other efforts to fight payment fraud, oppose bills to 
curtail payment fraud work 

Dear Chairman Bachus and Ranking Member Johnson 

Americans for Financial Reform and the undersigned community, consumer and civil righls 
groups urge you to support efforts to ensure that banks and payment processors avoid facilitating 
illegal activity by complying with longstanding due diligence requirements to know their 
customers, monitor return rates, and be alert for suspicious activity Please oppose any bills to 
defund or weaken efforts to fight payment fraud or to insulate banks or payment processors that 
do not conduct appropriate due diligence or ignore red flags We need every tool to fight data 
breaches, identity theft, scams, frauds, money laundering, and other illegal conduct 

Fraudsters Seed Hanks and Payment Processors to Access the Payment System 

Many scams, frauds and illegal activity could not occur without access to the payment system 
Banks and payment processors that originate payments play a critical role in enabling 
wrongdoers to debit victims* bank accounts and to move money around Examples of unlawful 
activity that would not be possible without an originating bank include the following, 

• A telemarketing scam defrauded seniors of $20 million by lying to them to get their bank 
account information 1 

• A lead generator tricked people who applied for payday loans and used their bank 
account information to charge them $35 million for unwanted programs. 2 

• Bogus debt relief services scammed consumers out of $8 million and made their debt 
problems worse ’ 

• Wachovia Bank enabled SI 60 million in fraud by scammers targeting vulnerable seniors 4 

• After an enforcement action against Wachovia, scammers moved (heir business to Zions 
Bank, which allowed it to continue despite spotting suspicious activity For example, a 
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telemarketer calling a senior about a purported update to his health insurance card tricked 
him into revealing his bank account information. - 

The FBI estimates that mass-marketing fraud schemes causes tens of billions of dollars of losses 
each year from millions of individuals and businesses, 6 and one study found that fraud drains 
$2.9 billion a year from the savings of senior citizens. 7 In addition, the data obtained in breaches 
like the recent Target, Michael’s and P.F. Chang breaches would be useless without a bank to 
use that data to debit bank or credit cards accounts. 

Banks are not always aware that they are being used to facilitate illegal activity. But when they 
choose profits in the face of blatant signs of illegality, they become an appropriate target for 
enforcement action. Indeed, if regulators do not take action against banks or payment processors 
facilitating illegal payments, they are left playing an impossible game of ‘whack a mole’ which 
makes it much too easy for fraudsters to get away with continuing to break the law, and 
processing institutions to continue to benefit from law-breaking. 

Payment Fraud Hurts Everyone 

Wrongdoers who access the payment system inflict harm on everyone. In addition to the direct 
victims of fraud, t he general public spends millions of dollars on identity protection products and 
loses faith in the security of the payment system. Retailers and online merchants lose business if 
consumers are afraid to shop on their website or at their store. Consumers' banks bear the 
customer friction and the expense of dealing with unauthorized charges. The fraudsters ' banks 
and payment processors may suffer regulatory or enforcement actions, lost customers, private 
lawsuits, and adverse publicity. American security is also put at risk when banks and processors 
that lack know-your-customer controls are used for money laundering for drug cartels, terrorist 
groups, and other criminals. 

DOFs Operation Choke Point 

The Department of Justice’s (DOJ) Operation Choke Point is aimed at banks that “choose to 
process transactions even though they know the transactions are fraudulent, or willfully ignore 
clear evidence of fraud.” 8 The focus is on illegal conduct, not activity that DOJ deems immoral. 

The first, and to date only, action that DOJ has brought as a result of Operation Choke Point is 
U.S. v. Four Oaks Fincorp, Tnc., Four Oaks Bank & Trust Co. Four Oaks enabled payments for 
illegal and fraudulent payday loans; an illegal Ponzi scheme that resulted in an SEC enforcement 
action; 9 a money laundering operation for illegal internet gambling payments; 10 and a recidivist 
prepaid card marketing scam that made unauthorized debits for a bogus credit line. 11 DOJ 
charged that the bank ignored blatant red flags of illegality, including extremely high rates of 
payments returned as unauthorized; efforts to hide merchants’ identities; offshore entities clearly 
violating U.S. laws; disregard for Bank Secrecy Act obligations by foreign entities; hundreds of 
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consumer complaints of fraud; and federal and state law violations, including warnings by 
NACHA and state attorneys general. 

This type of disregard for know-your-customer requirements and the legality of payments is 
what led to last month’s$8.9 billion penalty against BNP Paribas for concealing billions of 
dollars in transactions for clients in Sudan, Iran and Cuba, 12 and to a $1.92 billion penalty against 
HSBC for helping terrorists, Iran, and Mexican drug cartels launder money . n It is impossible to 
read the Four Oaks complaint without concluding that Operation Choke Point is essential work 
for which DOJ should be applauded, not criticized. 14 Calls to abandon Operation Choke Point 
are misguided and inappropriate. 

Regulators Have Appropriately Warned Banks to be Aware of High-Risk Activities, But Banks 
Need Not Reject Legal Businesses 

Separate from DOJ’s Operation Choke Point, bank regulators have asked banks to be aware of 
higher-risk activities, defined as areas with a “higher incidence of consumer fraud or potentially 
illegal activities.” 15 As with Operation Choke Point, the focus of bank regulators is on areas 
where fraud or illegal activity is prevalent. For example, telemarketing, credit repair services, 
and debt forgiveness programs have long been problematic areas plagued with fraud and 
deceptive conduct. Payday lending is a high-risk activity because it is completely unlawful in 15 
states, is unlawful in nearly every other state if the lender lacks a state license, and, especially for 
online lending, often results in repeated debits that the consumer did not knowingly authorize. 

Regulators have also made clear that banks that “properly manage these relationships and risks 
are neither prohibited nor discouraged” from providing services to lawful customers in high-risk 
areas. 16 Banks need only be aware of the potential for illegal activities, know their customers, 
including basic due diligence of high-risk businesses; 17 monitor payment return rates; and be 
alert for suspicious activity. These are not new obligations, but they are essential ones. 

Some recent headlines have drawn sweeping, unsubstantiated conclusions based on individual 
bank account closures. Banks close accounts every day for a variety of reasons. The bank that 
closed the account of the adult entertainer, for example, has stated unequivocally that it was 
unrelated to either Operation Choke Point or any policy concerning her profession. 18 The same 
is true of a gun dealer who was cut off by its payment processor. 19 

Even the National Rifle Association has said: 

“[W]e have not substantiated that [anti-gun groups’ efforts] are part of an overarching 
federal conspiracy to suppress lawful commerce in firearms and ammunition, or that the 
federal government has an official policy of using financial regulators to drive firearm or 
ammunition companies out of business.” 

Concerns by payday lenders that they are being rejected by some banks go back a decade or 
longer, long before the 2013 Operation Choke Point or the FDIC’s 201 1 guidance on payment 
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processing relationships. For example, in 2006, theFinancial Service Centers of America 
(FiSC A), which represents check cashers, money transmitters and payday lenders, testified: 

“For the past six years [since 2000] banks have been abandoning us - first in a trickle, 
then continuously accelerating so that now few banks are willing to service us . . .” 20 

Anecdotes about a few closed accounts do not prove regulatory overreach. The bank could have 
seen signs of illegality; terminated a problematic processor that had both illegal and legal clients; 
terminated businesses that lacked adequate controls; made its own business decision to cut ties 
with payday lenders after the bank suffered adverse publicity from its own payday lending; or 
misunderstood inflammatory headlines and regulatory signals. 

Some bank account closures may also be related to anti -money laundering (AML) and Bank 
Secrecy Act issues that are separate from whether the business is considered a high-risk business. 
Some payday lenders with state licenses are also check cashers and money transmitters, areas 
that require compliance with complicated but important AML rules. Recent money laundering 
settlements may have drawn more attention to those rules, andthe fact that Operation Choke 
Point is now in the news does not mean that every bank account closure is related. 

Regulators are working to clear up any misconceptions created by overreaching headlines or 
exaggerated lobbyist claims, while also emphasizing the importance of work to prevent payment 
fraud. As FDIC Vice Chairman Thomas M. Hoenig said recently: 

[I]f the bank knows its customer, takes the necessary steps, has the right controls, then 
they ought to be able to engage with them. . . . But you need to do those things like BSA 
[compliance].. . . T do believe we have an obligation to say, “If you are following these 
rules, [you] have to then judge the risk that [you] are willing to take on.” That’s the 
process and T’m very comfortable with that. 21 

It is irresponsible and dangerous to halt scrutiny of banks and payment processors that close their 
eyes when they operate in areas with a high risk of illegality. There are thousands of banks in 
this country and plenty that will continue to handle high risk but lawful accounts. But the tens of 
billions of dollars that Americans lose to fraud every year and the harms permitted by money 
laundering are just too great to abandon all vigilance by banks and payment processors that are in 
a position to stop illegal activity. 

Small Banks are Not a Target But May be Disproportionately At Risk 

Banks large and small have received subpoenas and enforcement actions related to payment 
fraud. Butsmall banks may be disproportionately likely to process illegal payments or be harmed 
by payment fraud. Some fraudsters target small banks that lack the internal controls to spot 
suspicious activity or that (like Four Oaks Bank) need capital and look the other way in exchange 
for fee income. High risk activities without due diligence are also more dangerous to the safety 
and soundness of a small bank. 


4 



34 


Moreover, more small banks are hurt by payment fraud than facilitate it. When the scammer’s 
bank submits an unauthorized charge against a consumer’s account, the consumer’s bank incurs 
expenses to deal with the mess. Those costs can be substantial for small banks. When a 
consumer contests an unauthorized payment, the average bank cost for handling a return is 
$4.99. But for a small bank the cost is much higher: the average is over $100 and can be as high 
as $509.90, according toNACHA, the Electronic Payments Association. 22 

The disproportionate impact of payment fraud on smaller banks is a reason to continue efforts to 
stop illegal activity. Tt is not a reason to halt such efforts. 

Conclusion 

Fighting payment fraud should not be controversial. Everyone benefits from efforts to stop 
illegal activity that relies on the payment system. We urge you to support efforts to ensure that 
banks and payment processors do their part and to hold them accountable when they fail to 
comply with know-your-customer requirements, conduct due diligence on high-risk activities, or 
overlook obvious signs of illegality. 

Yours very truly, 

Americans for Financial Reform 
Arizona Community Action Association 
Arkansas Against Abusive Payday Lending 
California Reinvestment Coalition 
Center for Economic Integrity (Arizona) 

Center for Responsible Lending 
Coalition of Religious Communities 
Consumer Federation of America 
Consumer Action 
Consumers Union 
Kentucky Equal Justice Center 

The Leadership Conference on Civil and Human Rights 

National Association of Consumer Advocates 

National Consumer Law Center (on behalf of its low income clients) 

National Fair Housing Alliance 
National People’s Action 
New Economy Project 
NW Consumer Law Center 
Public Citizen 
Public Justice Center 

South Carolina Appleseed Legal Justice Center 
Texas Appleseed 
U.S. PTRG 

Virginia Citizens Consumer Council 
Virginia Partnership to Encourage Responsible Lending 
Virginia Poverty Law Center 
Woodstock Institute 
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Cc: Members of the House Judiciary Committee Subcommittee on Regulatory Reform, 
Commercial and Antitrust Law 
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15 FDIC, Payment Processor Relationships, FIL-3-2012 (Jan. 31, 2012), available at 
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10 FDIC, Supervisory Approach to Payment Processing Relationships With Merchant Customers That Engage in Higher-Risk 
Activities, FIL-43-2013 (Sept. 27, 2013). 
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18 Dana Liebelson, "Is Obama Really Forcing Banks to Close Porn Stars' Accounts? No, Says Chase Insider," Huffington Post 
(May 8, 2014), available at http://www. motheriones.com/politics/2Q14/05/operation-chokepoint-banks-porn- 
stars(quoting Chase source as saying: "This has nothing to do with Operation Choke Point ... we have no policy that would 
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for merchants selling firearms and ammunition, so long as they meet our longstanding credit/risk management 

policy requirements... These policies were implemented before the DOJ's Operation Choke Point and are unrelated." 
Jennifer Bjorhus, Star Tribune, "Federal antifraud initiative goes too far, banks say" (June 7, 2014), available at 
http://www.startribune.com/business/262167821.html . 
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20 Gerald Goldman, General Counsel of FiSCA, "Summary Of speech before the U.S. House Committee on Financial 
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2006), available at 
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_6_21_06.pdf. 
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Associate Director, National Consumer Law Center 
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Americans for Financial Reform 
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On 

“Examining Regulatory Relief Proposals for Community Financial Institutions, Part II” 

Before the Before the House Financial Services Committee 
Subcommittee on Financial Institutions and Consumer Credit 

luly 15, 2014 

Chairman Capito, Ranking Member Meeks and Members of the subcommittee: 


Thank you for inviting me to testify today on behalf of Americans for Financial Reform, 
the low income clients of the National Consumer Law Center, the Center for Responsible 
Lending, Consumer Federation of America, and U S. PIRG. 


1 am here today to testify in support of Operation Choke Point and in opposition to H.R. 
4986, which would undermine important efforts underway at the Department of Justice and 
banking regulators designed to ensure that banks do not facilitate illegal activity. I urge you to 
oppose any bills to weaken the ability of regulators to fight payment fraud or to insulate banks 
that do not comply with the law or that willfully ignore signs that they are enabling fraud, scams 
and other illegal conduct. We need every tool to fight data breaches, identity theft, scams, 
frauds, money laundering, and other illegal conduct. 
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T will first explain why vigilance by banks is so important to stop illegal activity. I will 
then discuss H.R. 4986 and will explain why it is inappropriate to immunize banks that fail to 
conduct due diligence or ignore red flags of illegality merely because the entity holds a state 
license, is registered as a money transmitter, or can find an attorney to say its conduct is legal. 

In brief, merely holding a state license is no guarantee that an entity is acting legally, is 
not engaged in fraud or deceptive conduct, or is complying with laws designed to prevent money 
laundering or other illegal activity. Vigilance over money transmitters is essential to prevent 
fraudsters from concealing themselves and to prevent money laundering and financing for drug 
cartels and terrorism. Finally, fraudsters have lawyers who are willing to defend them, but the 
idea that a bank should be able to take a fraudster’s attorney’s word for the legality of payments 
and to ignore other signs of illegality is simply astounding. 

I also join the testimony of Marcus Stanley of Americans for Financial Reform 
expressing serious concerns about the discussion draft of The Access to Affordable Mortgages 
Act of 2014, which would exempt “higher-risk mortgages” of $250,000 or under less that are 
held on the lender’s balance sheet from new appraisal requirements included in the Dodd-Frank 
Act. The exemption would expose both consumers and financial institutions to the risks of an 
inflated appraisal. 

Fraudsters Need Bunks to Access the Payment System 

Many scams, frauds and illegal activity could not occur without access to the consumer’s 
bank or credit card accounts through the payment system. Banks that originate payments play a 
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critical role in enabling wrongdoers to debit victims 7 bank accounts and to move money around. 
Examples of unlawful activity that rely on an originating bank to process payments include the 
following: 

• A $600 million internet pyramid and Ponzi scheme shut down by the SEC . 1 

• A telemarketing scam defrauded seniors of $20 million by lying to them to get their 
bank account information.* 

• A lead generator tricked people who applied for payday loans and used their bank 
account information to charge them $35 million for unwanted programs. 3 

• Bogus debt relief services scammed consumers out of $8 million and made their debt 
problems worse. 4 

• Wachovia Bank enabled $ 1 60 million in fraud by scammers targeting vulnerable 
seniors. 5 

• After an enforcement action against Wachovia, scammers moved their business to 
Zions Bank, which allowed it to continue despite spotting suspicious activity. For 
example, a telemarketer calling a senior about a purported update to his health 
insurance card tricked him into revealing his bank account information. 6 

• Just last week, the FTC obtained a $6.2 million settlement against a payday loan 
broker that falsely promised to help consumers get loans and then used consumers’ 
bank account information to make unauthorized withdrawals without their consent. 7 

The FBI estimates that mass-marketing fraud schemes cause tens of billions of dollars of 
losses each year from millions of individuals and businesses. 8 A MetLife study found that fraud 
drains $2.9 billion a year from the savings of senior citizens. ' 1 In addition, the data obtained in 
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breaches like the recent Target, Michael’s and P.F. Chang breaches would be useless without a 
bank willing to use that data to debit bank or credit cards accounts. 

Even when consumers voluntarily authorize a payment from their account to purchase a 
product or repay a loan, they may find that their account is repeatedly debited for fees or charges 
they did not authorize or additional products they did not buy. Just last month, a judge agreed 
with the FTC that a payday lender had deceived consumers about the cost of their loans by 
imposing undisclosed charges and inflated fees that were automatically deducted from their bank 
accounts . 10 Those deductions could not have been made without a bank to process the debits. 

Banks are not expected to verify the legality of every payment they process, and they are 
not always aware that they are being used to facilitate illegal activity. But when they choose 
profits in the face of blatant signs of illegality, they become an appropriate target for 
enforcement action. Indeed, if regulators do not take action against banks facilitating illegal 
payments, they are left playing an impossible game of ‘whack a mole’ which makes it much too 
easy for fraudsters to get away with continuing to break the law, and processing institutions to 
continue to benefit from law-breaking. 

Payment Fraud Hurts Everyone 

Wrongdoers who access the payment system inflict harm on everyone. In addition to the 
direct victims of fraud: 

• The general public spends millions of dollars on identity protection products and 
loses faith in the security of the payment system; 

• Retailers and online merchants lose business if consumers are afraid to shop on their 


website or at their store; 
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• Consumers’ banks bear the customer friction and the expense of dealing with 
unauthorized charges; 

• The fraudsters’ banks may suffer regulatory or enforcement actions, lost customers, 
private lawsuits, and adverse publicity; and 

• American security is put at risk when banks and processors that lack know-your- 
customer controls are used for money laundering for drug cartels, terrorist groups, 
and other criminals. 

DUJ’s Operation Choke Point 

The Department of Justice’s (DOJ) Operation Choke Point is aimed at banks that “choose 
to process transactions even though they know the transactions are fraudulent, or willfully ignore 
clear evidence of fraud .” 1 1 The focus is on illegal conduct, not activity that DOJ deems immoral. 

The first, and to date only, action that DOJ has brought as a result of Operation Choke 
Point is U.S. v. Four Oaks Fincorp, Inc., Four Oaks Bank & Trust Co. Four Oaks enabled 
payments for illegal and fraudulent payday loans; an illegal Ponzi scheme that resulted in an 
SEC enforcement action ; 12 a money laundering operation for illegal internet gambling 
payments;” and a prepaid card marketing scam that made unauthorized debits for a bogus credit 
line . 14 DOJ charged that the bank ignored blatant red flags of illegality, including extremely 
high rates of payments returned as unauthorized; efforts to hide merchants’ identities; offshore 
entities clearly violating U.S. laws; disregard for Bank Secrecy Act obligations by foreign 
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entities; hundreds of consumer complaints of fraud; and federal and state law violations, 
including warnings by NACHA and state attorneys general. 

This type of disregard for know-your-customer requirements and the legality of payments 
is w'hat led to last month’s$8.9 billion penalty against BNP Paribas for concealing billions of 
dollars in transactions for clients in Sudan, Iran and Cuba, 13 and to a $1.92 billion penalty against 
HSBC for helping terrorists, Iran, and Mexican drug cartels launder money. 16 

It is impossible to read the Four Oaks complaint without concluding that Operation 
Choke Point is essential work for w'hich DOJ should be applauded, not criticized. 17 Calls to 
abandon Operation Choke Point are misguided and inappropriate. 

Regulators Have Appropriately Warned Ranks to be Aware of High-Risk Activities, hut Ranks 
Need Not Reject Legal Businesses 

Separate from DOJ’s Operation Choke Point, bank regulators have asked banks to be 
aw'are of higher-risk activities, defined as areas with a “higher incidence of consumer fraud or 
potentially illegal activities.’’ 18 As with Operation Choke Point, the focus of bank regulators is 
on areas w'here fraud or illegal activity is prevalent. For example, telemarketing, credit repair 
services, and debt forgiveness programs have long been problematic areas plagued with fraud 
and deceptive conduct. 

Payday lending is a high-risk activity because it is completely unlawful in 15 states, is 
unlawful in nearly every other state if the lender lacks a state license, and, especially for online 
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lending, often results in repeated debits that the consumer did not knowingly authorize. For 
example, the Four Oaks complaint described how many consumers were defrauded when they 
authorized a single payment from their bank account but found that the payday lenders debited 
their accounts repeatedly, without authorization, and would not stop. 

Banks are permitted to provide services for entities that operate in high-risk areas as long 
as the bank undertakes due diligence to obtain reasonable assurances that the entity is operating 
legally. Regulators have made clear that banks that “properly manage these relationships and 
risks are neither prohibited nor discouraged” from providing services to lawful customers in 
high-risk areas . 19 Banks need only be aware of the potential for illegal activities; know their 
customers, including basic due diligence of high-risk businesses;" 1 ' monitor payment return rates; 
and be alert for suspicious activity. These are not new obligations, but they are essential ones. 

Some recent headlines have drawn sweeping, unsubstantiated conclusions based on 
individual bank account closures. Banks close accounts every day for a variety of reasons. The 
bank that closed the account of the adult entertainer, for example, has stated unequivocally that it 
was unrelated to either Operation Choke Point or any policy concerning her profession . 21 The 
same is true of a gun dealer who was cut off by its payment processor. 2 ' 

Indeed, the National Rifle Association has said: 

“[W]e have not substantiated that [anti -gun groups’ efforts] are part of an overarching 

federal conspiracy to suppress lawful commerce in firearms and ammunition, or that the 
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federal government has an official policy of using financial regulators to drive firearm or 
ammunition companies out of business.” 

Concerns by payday lenders that they are being rejected by some banks go back a decade 
or longer, long before the 2013 Operation Choke Point or the FDIC’s 2011 guidance on payment 
processing relationships. For example, in 2006, the Financial Service Centers of America 
(FiSCA), which represents check cashers, money transmitters and payday lenders, testified: 

"Tor the past six years [since 2000] banks have been abandoning us - first in a trickle, 
then continuously accelerating so that now few banks are willing to service us . . ” 2! 

Anecdotes about a few closed accounts do not prove regulatory overreach. Banks close 
accounts for many reasons that may be unrelated to regulatory pressure or may be an appropriate 
response to regulatory guidance. Among other reasons, the bank could have: 

• seen signs of illegality or fraud, even with a licensed entity, such as high rates of 
payments challenged as unauthorized; 

• terminated a problematic payment processor that had both illegal and legal merchant 
clients; 

• terminated businesses, like a payday lender that also does money transmitting, that 
lacked adequate controls to prevent money laundering; 

• made the bank’s own business decision to cut ties with payday lenders after the bank 
suffered adverse publicity from its own triple-digit deposit advance payday lending; 
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• eliminated unprofitable accounts in areas where the risks of illegality are not worth the 
effort to conduct due diligence; or 

• misunderstood regulatory signals and inflammatory headlines. 

Some bank account closures may be related to anti-money laundering (AML) and Bank 
Secrecy Act issues that are separate from whether the business is considered a high-risk business. 
Some payday lenders with state licenses are also check cashers and money transmitters, areas 
that require compliance with complicated but important AML rules. Recent money laundering 
settlements may have drawn more attention to those rules, and the fact that Operation Choke 
Point is now in the news does not mean that every bank account closure is related to it. 

Regulators are working to clear up any misconceptions created by overreaching headlines 
or exaggerated lobbyist claims, while also emphasizing the importance of work to prevent 
payment fraud. As FDIC Vice Chairman Thomas M. Hoenig said recently: 

[I]f the bank knows its customer, takes the necessary steps, has the right controls, then 
they ought to be able to engage with them . . . . But you need to do those things like BSA 
[compliance]. . . . Ido believe we have an obligation to say, “If you are following these 
rules, [you] have to then judge the risk that [you] are willing to take on.” That’s the 
process and I’m very comfortable with that . 24 

It is irresponsible and dangerous to halt scrutiny of banks that close their eyes when they 
operate in areas with a high risk of illegality. There are thousands of banks in this country and 
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plenty that will continue to handle high risk but lawful accounts. But the tens of billions of 
dollars that Americans lose to fraud every year and the harms permitted by money laundering are 
just too great to abandon vigilance by banks that are in a position to stop illegal activity. 

Small Batiks are Not a Target But May be Disproportionately at Risk 

Banks large and small have received subpoenas, enforcement actions and regulatory 
guidance related to payment fraud. But small banks may be disproportionately likely to process 
illegal payments and, even more so, are disproportionately likely to be harmed by payment fraud. 

Some fraudsters target small banks that lack the internal controls to spot suspicious 
activity or that (like Four Oaks Bank) need additional revenue and are willing to look the other 
way in exchange for fee income. High risk activities without due diligence are especially 
dangerous to the safety and soundness of a smaller bank, particularly one that is 
undercapitalized. 

On the flip side, more small banks are on the receiving end of illegal payments, not the 
originating end, and are themselves victims of payment fraud facilitated by other banks. When 
the scammer’s bank submits an unauthorized charge against a consumer’s account, the 
consumer’s bank incurs expenses to resolve the issue. 

Those costs can be substantial for small banks. When a consumer contests an 
unauthorized payment, the average bank cost for handling a return is $4.99. But for a small bank 
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the cost is much higher: the average is over $100 and can be as high as $509.90, according to 
NACHA, the Electronic Payments Association."' 

The disproportionate impact of payment fraud on smaller banks is a reason to continue 
efforts to stop illegal activity. It is not a reason to halt such efforts. 

II. R. 4986 Would Immunize Banks that Ignore Signs of Illegal Conduct and Would 
Undermine Essential Efforts to Fight Money' Laundering , Payment Fraud and Illegal Activity 
H.R. 4986 provides a highly problematic safe harbor for financial institutions that 
knowingly process payments for unlicensed merchants and fraudsters or willfully ignore signs of 
illegality. The bill also curtails the Department of Justice’s ability to compel the production of 
important information necessary to determine if banks are facilitating illegal activity. 

The bill forbids regulators from prohibiting, restricting or discouraging financial 
institutions from providing any product or service to an entity that: 

• is licensed and authorized to offer such product or service; 

• is registered as a money transmitting business; or 

• has a “reasoned” legal opinion from a state-licensed attorney that purports to 
demonstrate the legality of the entity's business under applicable Federal and State law, 
tribal ordinances, tribal resolutions, or tribal-State compacts. 

That is, regulators could not discourage financial institutions from providing processing 
services to an entity even if the institution observed alarmingly high levels of payments 


ii 



49 


challenged as unauthorized, was warned by federal or state law enforcement officials that the 
entity appeared to be engaged in fraudulent or deceptive conduct, knew that the entity had 
numerous court orders against it, or saw signs that the entity was attempting to conceal unlawful 
activity. 

The fact that an entity holds a state license is no guarantee that it will not engage in 
unlawful activity, CashCall, Inc. for example, is a licensed lender in many states. But the CFPB 
has charged that CashCall, acting as a servicer and debt collector on payday loans made by 
Western Sky, debited consumer checking accounts for money they did not owe and continued 
debiting accounts even after Western Sky shut down its operations in response to numerous state 
enforcement actions and court orders. 20 CashCall has also faced prosecution by state attorneys 
general for its own lending activities, and California is in the process of revoking its license. 

Yet, under H R. 4986, regulators would not be permitted to advise financial institutions 
of the risks of processing payments for CashCall or from discouraging financial institutions from 
processing payments for entities facing similar government enforcement activity. The bill would 
not only permit continued debiting of consumer accounts for unlawful payments, it would also 
put financial institutions at risk of liability for chargebacks and legal action by consumers and 
others. 


Similarly, even if an entity is registered as a money transmitting business, it could be 
violating the law or facilitating money laundering, consumer fraud, or other illegal activity. For 
example, Arizona Attorney General Tom Home recently obtained a $94 million settlement with 
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Western Union, which was sending “blood wires” that permitted organized criminal cartels to 
smuggle money across the Arizona border. Attorney General Horne took the action to protect 
Arizonans from border violence, gun running, and human and narcotic smuggling along the 
southwest border. 27 

Under H.R. 4986, if a financial institution was serving a licensed money transmitter that 
was facilitating similar conduct, regulators could not discourage the activity or advise the 
financial institution of the risks. 

Finally, virtually any criminal can find an attorney to defend its conduct, and sometimes 
the criminal hides the facts even from its own attorney. A legal opinion by an attorney that an 
activity is permissible should not absolve a financial institution from its obligation to conduct 
due diligence on of the third parties with which it does business and to keep its eyes open for 
suspicious activity. Financial institutions have clear guidance from regulators about how to 
manage relationships with third parties, including payments processors, and a letter from the 
third party’s attorney cannot trump that guidance. 

While this provision will aid any fraudster who has the ability to hire an attorney to write 
a letter on its behalf, it may have a particular impact on stopping regulators from advising 
financial institutions of the risks if they process payments for purportedly tribal entities that 
conduct activities off reservation in violation of state law. The Supreme Court’s recent decision 
in the Bay Mills case should have made clear that tribes must obey state law when they act off 
reservation even if they have a license issued by a tribal entity to conduct business on tribal land. 
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A state “can shutter, quickly and permanently, an illegal casino,” and the same is true of an 
illegal payday loan operation, by denying a license, obtaining an injunction, and even using the 
criminal law. 28 Yet even if the legality of unlicensed tribal payday lending is still up for debate, 
financial institutions that process electronic payments over the ACH system and remotely created 
checks over the check system provide warranties about the validity of those payments. If the 
payments turn out to be unlawful, the financial institution is on the hook to the consumer's bank, 
and a letter from the payday lender’s attorney will not help. Regulators are only doing their duty 
to look out for the safety and soundness of financial institutions when they advise them of these 
high risk activities designed to evade state law. 

HR 4986 also curtails the Department of Justice’s ability to issue subpoenas in 
connection with its investigations of financial fraud. A subpoena is merely a request for 
information. If a financial institution is potentially facilitating illegal activity, a subpoena is an 
important tool to determine the facts. Abusive practices, especially in cases of payments fraud, 
are hard to detect. For fraudsters, this is by design - the best scams are those that go undetected 
for as long as possible - so we cannot tie the hands of the regulators charged with enforcing the 
law. Regulators must have the ability to examine financial institutions, ensure that appropriate 
compliance procedures are in place, and when necessary, issue subpoenas, to detect fraud and 
investigate potential abuses. 

Conclusion 

Fighting payment fraud should not be controversial. Everyone benefits from efforts to 

stop illegal activity that relies on the payment system. I urge you to oppose H.R. 4986 and other 
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measures that would undermine efforts to ensure that banks comply with know-your-customer 
requirements, conduct due diligence on high-risk activities, and keep an eye out for signs of 
illegality. Everyone must do their part to protect the integrity of the payment system and to 
prevent illegal activity that harms millions of Americans, businesses and American security. 


Thank you for inviting me to testify today. I would be happy to answer any questions. 
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(Nov. 11, 2013). The NACHA study does not give an average cost for small banks, but the un-weighted average for 
all banks is $100.52, so the average for smaller banks is undoubtedly higher than that. The weighted average for 
all banks, taking into account each bank's volume, is $4.99. 

26 "CFPB Sues CashCall for Illegal Online Loan Servicing," Consumer Financial Protection Bureau (December 13, 
2013) available at http://www.consumerfinance.gov/newsroom/cfpb-sues-cashcali-fQr-iliegal-oniine-loan- 
servicing/ 

^Arizona Attorney General, "Western Union: CUTTING OFF THE ILLEGAL CASH FLOW: $94 Million Settlement to 
Aid Law Enforcement in Fighting Border Crime" (Feb. 3, 2014), available at https://www.azag.gov/border- 
secu r ity/we stern-union. 

28 Michigan V. Bay Mills Indian Community et al., 134 S.Ct. 2024, 2035 (2014). 
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July 15,2014 


The Honorable Spencer Bachus 
United Slates House of Representatives 
2246 Rayburn Building 
Washington, DC 20515 

The Honorable Hank Johnson 
United States House of Representatives 
2240 Rayburn HOB 
Washington, DC 205 1 5 


Re: Hearing on Operation Chokepoint 


Dear Chairman Bachus and Ranking Member Johnson: 

1 am Adjunct Professor of Law at the Law School of the University of Pennsylvania and 
the founding partner of Langer Grogan & Diver, P.C. I have spent the last eight years in cases 
involving banks, third party payment processors and mass market frauds. I was lead counsel in 
Faloney v. Wachovia Bank in which the bank paid full damages to some 750,000 victims of 
approximately 130 mass market frauds who had had money debited from their accounts. 
Wachovia had given the frauds aceess to the banking system through the use of several third 
party payment processors that Wachovia knew had taken on mass market frauds as customers. 
Over $150 million was recovered from Wachovia, representing the full amount taken from the 
victims’ accounts. The victims could also file claims for overdraft fees that resulted from the 
funds having been taken from their accounts. 

The behavior of Wachovia lias been repeated over and again by other banks. Operation 
Chokepoint merely represents the continuation, albeit more intensively, of government actions 
seeking to curb banks and third party payment processors front enabling mass market fraud. This 
is no mere effort to recover from the deep pockets. In the cases I describe below the banks were 
fully on notice- actually aware — that they were enabling frauds through the accounts they 
serviced for third party payment processors. 
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Wachovia involved each of the elements at issue in Operation Chokepoint: a bank, third 
party payment processors, and multiple mass market frauds, Wachovia maintained the account ot 
one payment processor. Payment Processing Center (“PPC’'), even alter its own due diligence 
report disclosed an: 

“article regarding a coupon scam in 1989 and 900-Line scam in 199! involving Donald 
Hellinger [the principal of PPC], The accused pled guilty to the coupon scam on October 
24, 1989 for which he would face 8 years imprisonment... Information was also found 
regarding a suit filed by the FTC allegedly involving a company owned by Donald 
Hellinger.. .for deceptively promoting credit cards and other products via 900 numbers." 

Each of the principals of PPC pled guilty to criminal charges growing out of their activities taken 
through Wachovia. Wachovia itself entered into a deferred prosecution agreement. Three other 
payment processors involved with Wachovia — Your Money Access, Suntasia, and Amerinet — 
were also subjects of government proceedings. 

Following Wachovia , the Comptroller of the Currency brought an action against T-Bank 
of Dallas for engaging in the same conduct. T-Bank provided accounts to a third party payment 
processor known as Giact Systems, which like PPC, had many mass market frauds as customers. 
As in the case of Wachovia, T-Bank was required to make full restitution to all the victims 
whose accounts had been raided by the frauds. See, http://www.occ.gov/static/enforcement- 
actions/ ea2010-067.pdf 

The Justice Department, in a joint action with banking regulators, brought an action 
against Ihe First Bank of Delaware for engaging in identical activity. It opened accounts for a 
series of third party processors all of which engaged in servicing mass market frauds. These 
included Landmark Clearing, Inc., Automated Electronic Checking, Inc., Check Site, Inc., and 
Check 2 1 .com, LLC. See, Complaint, United Slates v. First Bank of Delaware, Civil Action No. 
12-6500 (E.D. Pa. 1 1/19/12) The government was unable to obtain full restitution for the victims 
of the frauds that had raided victims' account through First Bank of Delaware because the bank 
lacked sufficient assets. Its charter was revoked. See, 
http://www.fincen.gov/news_room/nr/html/20121 1 19.html. 

The Committee is familiar with the successful Justice Department action against Four 
Oaks which also enabled frauds through a third party payment processor. 

My own firm has brought an action against Zions first National Bank a large bank 
located in Utah. Zions used a wholly owned third party processor for which it opened accotmts in 
order to bank accounts that it acknowledged it would never have accepted directly. Not 
surprisingly 49% of revenue of the payment processor, known as Modem Payments (“MP/ND"), 
was derived from mass market frauds ultimately shut down by the FTC or the Justice 
Department. The type of businesses Modern Payments serviced is described in F.T.C. v. NHS 
Sys., Inc.. 936 F, Supp. 2d 520, 526 (F..D. Pa. 2013). In the case against Zions. die district court 
found that the plaintiffs had pled facts establishing Zions' knowledge of the fraud of the entities 
it was servicing: 
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Reyes has sufficiently pleaded his § 1 962(c) claims against the Zions Defendants, He 
alleges Zions Bank and MP/N'D each serve independent and crucial roles in conducting 
an enterprise with the common purpose of earning fees for facilitating fraudulent 
telemarketing schemes. ...In alleging die Zions Defendants knew die transactions were 
fraudulent, Reyes pleads facts showing Zions Bank and MP/ND were aware of several 
blatant indications of fraud, including NHS's and related telemarketers' staggeringly high 
rates of ACH returns, and in particular, rates of return for lack of authorization. Reyes 
asserts Zions Bank discussed the high return rates with MP/ND, and MP/ND 
communicated frequently with the allegedly fraudulent telemarketers about their return 
rates. Reyes also alleges Zions Bank and MP/ND received notification from another bank 
they were violating NACHA's rule prohibiting ACH TEL transactions for outbound 
telemarketing... 

Reyes v. Zion First Nat. Bank. CIV .A. 10-345, 2012 WL 947139 (E.D. Pa. Mar. 21, 2012) 

The court subsequently denied class certification in die Zions action and die Third Circuit 
has accepted interlocutory review of the decision. If Zions is successful in sustaining the district 
court’s decision on appeal, cases like diose brought under Operation Chokepoint becomes all the 
more important since victims otherwise would lack a means of redress. The AARP, the 
Consumer federation of America, The National Consumer Law Center. Senators Casey, 
Blumenthal and Markey and others have filed friend-of-coun briefs supporting reversal of the 
denial of class certification in Zions. 

The cases discussed above underscore the importance of Operation Chokepoint. The 
various frauds migrated from bank to bank. Hie very same persons who operated the NHS fraud 
through Zions had operated a similar fraud dirougb Wachovia. Several of the frauds involved in 
the T-Bank and First Bank of Delaware cases had simply migrated to Zions. Had the banks 
engaged in the most rudimentary due diligence they would have turned up these migrating 
frauds. Wachovia and Zions both obtained the fraudulent customers through what are known as 
account brokers. The account broker who brought PPC to Wachovia testified that four other 
banks had refused to open accounts for PPC before Wachovia accepted iL. The perpetrator of the 
NHS fraud testified that he was approached by an account broker who brought his account to 
Zions within twenty-four hours of losing his prior access to the banking system, through a court 
order freezing PPC’s accounts at Wachovia. The banks engaged in servicing these frauds did not 
innocently stumble into the business when a new depositor simply w alked through the doors and 
asked to open an account. 

Nor is the Department of Justice requiring anything new of banks. For years the 
Comptroller of the Currency has made it clear dial banks had a special obligation to undertake 
particularly careful due diligence in taking on third party processors accounts. This is set out in 
detail in the government’s complaint against Four Oaks, so 1 do not repeat it here. The fact that 
the government has stepped up enforcement should be endorsed by Congress, not criticized. It is 
only when banks follow the regulatory requirements of due diligence in accepting accounts that 
such mass fraud will stop. The frauds will lose access to the victims’ bank accounts. 
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II is not surprising that the recently formed association of third party payment processors 
urges action against Operation Chokepoint. The many actions I have described above confirm 
the warnings that the banking regulators have been providing to banks that accepting accounts of 
third party payment processors are fraught with risks. At least eleven different third party 
payment processors are identified in the complaints described above as having served as conduits 
for hundreds of millions of dollars in mass market fraud. 

The representatives of the payday lending industry also urge that Operation Chokepoint 
be shut down. As the Committee knows, payday lending is outlawed in many stales, like my own 
state, Pennsylvania. Payday lenders charge exorbitant interest rates, often exceeding 100%, and 
only the most desperate avail Uiemsetves of such usurious loans. But putting that aside that most 
basic moral concern, experience in the above cases show's that payday lending has been 
associated with mass market frauds. Certain of the frauds at issue in the Zions matter were 
payday loan referral cites which obtained victims’ bank account information and used the 
information to raid victims’ accounts through the electronic debit system. Worse, it is common 
for such frauds to exchange these illicitly compiled lists with each other. A so- called 
"legitimate” payday lender and payday loan referral site. Money Mutual, has a small print 
‘‘privacy” policy on its website which makes explicit that it may sell the banking information it 
obtains to telemarketers: 

If you choose to provide personal information, ... We reserve the right to share, rent, sell 
or otherwise disclose your information with/to third parties in accordance with applicable 
laws and as described herein. These third party businesses may include, but are not 
limited to: providers of direct marketing services and applications, including ...; e-mail 
marketers; . . . and telemarketers. Information collected by us may be added to our 
databases and used for future instant messaging, telemarketing.,, . 

It is difficult to understand why anyone, let alone public servants, would undertake any 
action on behalf of such entities to curb the very type of enforcement activity citizens expect 
from government. 1 hope that the Committee will find from the above that there is good reason 
for the Department of Justice to pursue the course undertaken in Operation Chokepoint. 

While I will be leaching abroad from August 3 through August 1 8, the committee should 
not hesitate to contact me should it want to explore the matters discussed above. 


Respectfully, 


Howard Langer 


cc: Members of the House Judiciary Committee 
Subcommittee on Regulatory Reform, 
Commercial and Antitrust Law 
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Purpose 

This bulletin provides guidance for national banks and examiners on managing the nsks of automated 
deartng house (ACH) activity. National banks may be exposed to a variety of nsks whan originating, 
receiving, or processing ACH transactions, or outsourcing these activities to a third party. This bulletin 
outlines the key components of an effective ACH risk management program. Each bank should use this 
guldanoe to develop an ACH risk management program that reflects the nature and complexity of the 
bank's activities. 

This bulletin supplements guidance on ACH activities contained In the FFIEC IT Examination Handbook 
on Retail Payment Systems. 1 dated March 2004, and National Automated Clearinghouse Operating 
Rules 2 and replaces OCC Bulletin 2002-2 (ACH Transactions Involving the Internet) 

Scope 

This guidance applies to 

• Banks acting as onginating depository financial institutions (ODFIs), 
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• Banks ading as receiving depository financial institutions (RDF Is), 

• Banks constdering these activities, and 

• Third-party service providers acting on behalf of an ODFI or RDFI. 

Background 

Advances in technology have brought about significant changes in the nature and volume of ACH activity. 
The growth in ACH volume results from fundamental changes In payment methods used by consumers 
and businesses. Recently, the OCC has seen banks engage in new ACH adivities without enhancing 
existing risk management systems and controls. Failure to implement appropriate controls for these 
activities is an unsafe and unsound practice and can result In increased credit, compliance, reputation, 
strategic.and transaction risks, and In some cases, deterioration in the bank's condition. 

ACH origination volume has increased as consumers and businesses look for more cost-effective and 
convenient payment alternatives. The most pronounced growth in ACH transactions over the last several 
years has been for nonrecumng payments. Consumers may initiate such payments over the telephone, 
on the Internet, or simply by writing a check that is converted to an ACH transaction. Some oommon 
nonrecurring payment types include accounts receivable conversion (ARC) 3 , pomt-of-purchase (POP). 
Internet-initiated (WEB), telephone-initialed (TEL), and re-presented check (RCK) entries. 

In addition to new and evolving types of ACH transactions, there are new participants m the ACH 
network, Including certain merchants and third parties known as third-party senders. Whereas a bank is a 
client of a traditional third-party service provider (often called an ACH vendor), the merchant Is the 
customer of a third-party sender (often called an originator aggregator or merchant processor) and the 
third-party sender is a customer of the bank. When a third-party sender is interposed between the bank 
and the originator, there is no contractual agreement between the bank and onginator. A bank should be 
aware o< the distinct risks arising from relationships With third-party senders. Although third-party senders 
are bank customers, they require oversight by bank management. Guidance on managing third-party 
senders can be found in the Third Party Senders section of this document 

Discussion 

ACH Risk Management Program 

Banks that participate in the ACH network, as well as their service providers, should have in place 
systems and controls to mitigate the risks associated with ACH activities, A strong risk management 
program begins with cleariy defined objectives, a well-developed business strategy, and clear risk 
parameters Both the board of directors and management are responsible for ensuring that the ACH 
program does not expose the bank to excessive nsk. The board's role is to establish the bank's overall 
business strategy and risk limits for the ACH program and to oversee management's implementation of 
the program. Bank management is responsible for establishing effective risk management systems and 
controls and regularly reporting to the board dm the results of the ACH program 

The bank's ACH program siiould indiide an ongoing process that evaluates whether ACH adivities are 
conducted within the risk parameters established by the board of directors. This process should also 
determine whether existing policies, procedures, and controls effectively address ad aspects of the bank’s 
ACH activities 

Risk Management Systems and Controls 

The systems and controls needed for an effective ACH risk management program indude written policies 
and procedures, strong internal controls, and a risk-based audit program. The depth and breadth of a 
bank’s ACH policies and procedures will depend on the scope and complexity of the ACH activities. 
Adequate policies and procedures generally include the following basic components: 

• A summary of the ACH program's objedives and Its role within the bank’s strategic plan; 

• Board -approved nsk tolerances that outline the types of adivities the bank may condud and the 
types of businesses approved for ACH transadlons. 

• Clearly defined duties and responsibilities that ensure strong internal controls over transadlons; 
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• An ACH credit-risk management program, and 

• An effective vendor management program, including a due diligence process for selecting third- 
party service providers, and an oversight process for monitoring them. 

Reporting to the Board of Directors 

To oversee management's execution of the ACH program effectively, the board of directors, or a 
committee thereof, should receive panodic reports that allow the board to determine whether ACH 
activities remain within board-established nsk parameters and are achieving expected financial results. 
Such reports generally Include: 

• Metrics 3nd trend analyses on ACH volume, returns, operational losses, and transaction typos, 
wfth explanations lor variances from prior reports: 

• Metrics and trend analyses related to the composition of the bank's portfolio of originators and, as 
applicable, third-party senders: 

• Capital adequacy relative to the volume of ACH activity and Ihe level of risk associated with 
originators: 

• The percentage of the deposit base that is linked to ACH origination activity: 

• A summary of return rates by originator, and, as applicable, third-party senders; 4 

• Unauthorized returns that exceed board-established thresholds; 

• Notices of potential and actual rules violations and fines by NACHA; 

• Financial reports on profitability of the ACH function as a cost center and 

• Risk management reports, inducing a comparison of actual performance to approved risk 
parameters. 


Audit 

The depth and breadth of a bank's ACH audit program will depend on the volume and complexity of Its 
ACH operations. The OCC has seen several cases in which a bank’s ACH audit program was not 
enhanced or strengthened to cover new or expanded products and services, including high-risk activities. 
Common deficiencies include inadequate audit coverage. Inexperienced audit staff, and a lack of 
appropriate auditor training. 

When establishing the ACH audit scope, auditors should consider issues such as growth in transaction 
volume, now products and services, now ACH systems, underwriting policies and customer due diligence 
(COD) policies and practices, and customers’ online acoess to the ACH network. 8ank management 
should also ensure that periodic audits of third-party service providers and third-party senders are 
performed. The audit should also check for completion ol the annual National Automated Cleanng House 
Association (NACHA) Rules Compliance Audit (Rules Audit) by the bank or third-oarly service provider. 
The Rules Audit, however, is only one element of an effective ACH audit program and is not a substitute 
for a comprehensive, nsk-hased audit 

The audit function should be staffed appropriately with auditors who have sufficient expertise to evaluate 
all aspects of the ACH program. The board should ensure that there Is sufficient expertise to carry out the 
bank's ACH audit activities, whether the function is performed by internal audit staff or an external audit 
firm. The board should also ensure that auditors attend training periodically to ensure [hat their skills keep 
pace with any expansion in the bank's ACH program. 

Credit Risk 

Banks’ credit-nsk exposures have Increased significantly with the expansion into higher-risk ACH activities 
such as nonrecunfng payments. Credit risk occurs in different forms, depending on the type of transaction 
and the bank's role in the transaction. For ACH credit entries, the originating bank (ODf I) Incurs credit 
risk upon initialing lire entries until its customer funds the account at settlement. The receiving bank 
(RDFI) Incurs credit risk If It grants its customer funds availability prior to settlement of the credit entry. 

For ACH debit entries, the ODFI incurs credit nsk from the lime it grants Its customer funds availability 
until the ACH debit can no longer be returned by the RDFI. 5 The RDFI's credit risk from a debit entry 
nses if it allows the debit to post and overdraw its customer's account (See Figure 1.) 
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Banks need to implement credit-risk controls that establish underwriting standards, require analysis of 
originators' creditworthiness, and sot appropriate credit exposure limits. Banks with more complex ACH 
programs or banks that do not mitigate credit risk through holdbacks or reserve accounts will need to 
develop more expansive credit-risk management systems. 

Figure 1 - Depicts the funds flow for an ACH debit transaction 6 


Establishing Originator 
Underwriting Standards 

As with other types of credit 
exposures, each bank's loan 
policies should include formal 
underwnting standards and an 
approval policy for ACH 
onginators. During an Initial 
review of originator Information, 
oanks typically reject originators 
that have a history of excessive 
unauthorized returns, or that do 
not operate a legitimate 

business The depth of a bank’s initial review should match the level of risk posed by the onginator 

Underwriting standards enable bank management to dearly communicate the process and documentation 
required for approving new originators and expanding existing originators' ACH activities. Under the 
board’s direction, bank management should Implement underwriting standards for all originators. Such 
standards generally 

• Define desirable, prohibited, and restneted originators 7 . 

• Require a background check of the onginator to validate the legitimacy of the business (if 
necessary, this check can be supplemented with a background check or the principal business 
owners of the originator); 

• Require evaluation of the originator's creditworthiness, including a comprehensive finandal 
analysis (similar to that performed on other potential unsecured borrowers). 

• Outline the type and timing of financial information to be provided by the originator 

• Require review of the originators sales history; 

• Summarize documentation requirements. Including social security number or tax identification 
number; 

• List permissible Standard Entry Class (SEC) types B . 

• Provide authorization procedures for approved onginators; 

• Provide guidelines for setting exposure limits, including requirements for pre-funding or collateral 
requirements; 

• Establish overtlmit monitoring and approval; 

• Outline originator account tennination procedures, and 

• Allow the bank to audrt originators’ ACH processes and controls at the bank’s discretion. 

Banks should use the underwriting standards listed above as guidance, to be adapted as necessary to 
reflect each Dank’s specific drcumstancos and individual risk profile. Banks engaged in complex or hlgh- 
nsk ACH transactions should implement more stringent underwriting standards than banks that only 
conduct traditional, lower-risk ACH transactions. 

Risk Selection - Analyzing Originator Creditworthiness and Establishing Exposure Limits 

Banks should perform ongoing credit analysis on ACH originators Analyzing creditworthiness is a cntical 
step in establishing and monitoring appropriate exposure thresholds for the type and volume of 
transactions processed by the bank. Banks should approach ACH credit analysis the same way they 
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evaluate other credit arrangements by considering the proposed activity (such as purpose of the loan), 
and determining through financial and other analysis how much unsecured credit to extend. The bank 
should maintain a credit file on the originator that will include the types of ACH transactions thal are 
authorized, the band's financial analysis and evaluation of creditworthiness, and approved exposure limits 
for daily and multi-day settlements. 

To manage credit risk effectively, banks should set ACH credit and debit exposure thresholds for 
originators and monitor the appropriateness of. and compliance with, such limits on a regular basis. 
Consistent with NACHA requirements, banks should establish separate exposure limits and monitoring 
practices for WEB entnes. Banks should also implement procedures to monitor ACH entries relative to 
the exposure limit across multiple settlement dates. Banks need lo be aware of the extended return time 
frames for consumer debit transactions. 9 Management should 

• Set limits and obtain appropnate internal approvals before allowing ACH transactions to be 
initiated; 

• Establish processes to ensure bank management remains abreast of originators' ongoing financial 
condition so management can take timely mitigating action, such as amending exposure limits or 
requiring pre-funding, and 

• Implement a process to ensure that approvals of over-limit transactions are well controlled and 
consistent with the bank's policies for extending unsecured credit. 

In cases in which the bank requires pre-funding before transactions are originated through the ACH 
network, the bank should ensure that It has collected funds before an ACH file Is sent to the ACH 
Operator. Banks require pre-funding far a variety of circumstances, but. at a minimum, should Impose 
such requirements on troubled borrowers. 10 

To further reduce credit risks, management should implement procedures that require lending and ACH 
operations personnel lo consult with one another at least annually or more often, if necessary, to confirm 
that the originator's financial condition has not changed from the time the credit facility was approved. 1 1 

High-Risk Activities 

Banks that engage in ACH transactions with high-risk originators or that involve third-party senders face 
Increased reputation, credit, transaction, and compliance risks. Hlgh-nsk originators include companies 
engaged In potentially illegal activities or that have an unusually high volume of unauthorized returns, 
High-risk originators often initrate transactions through third-party senders because they have difficulty 
establishing a relationship directly with a bank. 

Examples of high-risk parties indude online payment processors, certain credit-repair sen/ices, certain 
mail order and telephone order (MOTO) companies, illegal online gambling operations, businesses 
located offshore, and adult entertainment businesses. These operations are inherently more risky and 
incidents of unauthorized returns are more common with these businesses 12 

Before a bank engages In high-risk ACH activities, the board of directors should consider carefully the 
risks associated with these activities, particularly the increased reputation, compliance, transaction, and 
credit risks The board should provide clear direction to management on whether, or to what extent, the 
bank may engage in such ACH activities. Some banks have established policies prohibiting transactions 
with certain high-risk originators and third-party senders. 

Banks thal engage in high-nsk ACH activities should have strong systems to monitor and control risk 
These systems should monitor the level of unauthorized returns, identify vanonces from established 
parameters such as origination volume, and periodically verify the appropriate use of SEC codes, as 
transactions are sometimes coded Incorrectly to mask fraud. 13 tn addition, transactions with higher-risk 
elements, such as TEL and WEB. should be monitored to ensure that they are within the institution’s risk 
tolerance. A high level ol unauthorized returns is often indicative of fraudulent activity 14 This indication 
may prompt management to terminate the relationship with the originator or third-party sender, or signal 
thal additional training is needed lo ensure compliance with ACH rules, 
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Compliance Risk 

A bank's compliance risk management system should Incorporate applicable policies, procedures, and 
processes for its ACH activities, including those conducted through third parties, 13 ACH reviews should 
be comprehensive and should test For compliance with a number of regulatory requirements, including 
Regulations CC, DO. and E, Bank Secrecy Act/Anti-Money Laundering (BSA/AML) and Offioe of Foreign 
Assets Control (OFAC) requirements, and NACHA and other network rules. 

If the bank's compliance review delects regulatory violations or errors on a consumer's account, bank 
management snould correct them in a timely manner Remedial action indude3 the timely crediting of the 
consumer's account, identifying the cause of the violation or error, and implementing any new policies, 
procedures, or controls needed to prevent recurrence. 

The Bank Secrecy Act requires banks to have BSA/AML compliance programs and appropriate polities, 
procedures, and processes in place to monitor and identify unusual activity, induding ACH transactions 
18 ACH transactions lhat are originated through a third-party service provider (when the originator is not a 
direct customer of the ODFI) may Increase BSA/AML nsk. Risks are heightened when neither the third 
party nor the OOF I performs due diligence on the companies for which they are originating payments. 1 7 

For relationships with a bank's or an originator's third-party service provider. CDD on the third-party 
service provider can be supplemented with due diligence on the principals associated with the third-party 
service piovlder. When a bank Is heavily reliant upon its third-party service provider, it should review the 
third-party service provider's suspiaous-aclivity monitoring and reporting program, either through Its own 
or an independent Inspection 18 

ACH transactions can be used in the layering and integration stages of money laundering. Detecting 
unusual activity in the layering and integration stages can be a difficult task, because ACH may be used 
to legitimize frequent and recurring transactions. Banks should consider the layering and integration 
stages of money laundering when evaluating or assessing the ACH transaction nsks of a particular 
customer. Because of the nature of ACH transactions, adequate and effective customer and nriginator 
due diligence policies, procedures, and processes are cntlca' In detecting unusual and suspicious 
activities. 

Equally important is an effective risk-based suspicious activity monitonng and reporting system. For banks 
originating transactions for noncustomers (i.e., through third parties), the suspicious-activity monitoring 
and reporting systems should include the monitoring of ACH detail activity when the betch-prooessed 
transactions are relumed or separated for other purposes 19 

The ODFI may need to more closely scrutinize transaction details for international ACH activities. 2,5 The 
ODFI, if frequently involved in international ACH, may develop a separate process for reviewing 
international ACH transactions that minimizes disruption to general ACH processing, reconcilement, and 
settlement. 

All parties to an ACH transaction are subject lo the requirements of OFAC With respect to domestic 
ACH transactions, the ODFI is responsible for verifying whether the originator is not a blocked party and 
for making a good faith effort to determine that Ihe originator Is not transmitting blocked funds. The RDFI 
similarly is responsible for verifying that the receiver is not a blocked party. ODFIs are not responsible for 
unbatching transactions If they receive those transactions already batched from their customers who have 
been placed on notice about their own responsibilities with regard to OFAC regulations. In such cases, 
ODFIs may rely on RDFIs for compliance with OFAC requirements wllh respect to blocking accounts and 
transactions on the RDFI's books. However, to the extent lhat unbatching occurs, the ODFI is responsible 
for screening as though it had done the initial batching, With respect to OFAC screening, these same 
obligations hold for cross-border ACH transactions. For outbound cross-border ACH transactions; 
however, the ODFI cannot rely on OFAC screening by the RDFI outside of the United States. 

Third-Party Service Providors 
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The us® of third parties in ACH transactions adds complexity and increases a bank's exposure to 
compliance, credit, transaction, and reputation risks. Use of third-party service providers, which conduct 
activities on behalf of a bank, increases risk because the bank remains legally responsible, but does not 
have direct control over the functions performed by the third party. (See Figure 2 .) Risks are even higher 
when the third party is permitted direct access to the ACH Operator on behalf of the bank. 21 Bank 
management should effectively oversee all ACH activity that is conducted through the bank. 22 

Figure 2 - Depicts the funds flow of a Third-Party Service Provider 23 

► Processing Agreements 



To effectively manage risk from tnird-party service providers, bank management should establish 
procedures that allow the bank to monitor the third-party service provider's operations. The first step in 
this process is identifying and validating the third party and the type of business It conducts. Banks should 
check thoroughly the background of each third-party service provider, including the principal owners, and 
also verify the organization's financial capacity to absorb losses. This step is particularly important If the 
bank allows the third party to have direct access lo the ACH Operator. 

Third-Party Senders 

Third-party senders are bank customers to which onginators outsource payment services, but the bank 
has no direct customer or contractual relationship with the originator. The third-party sender provides 
services to the ongmatcr and. in that capacity, ads as an intermediary between the otiginator and the 
ODFI Because of the complexity of these arrangements, banks often lack appropnate controls over 
activities involving third-party senders. (See Figure 3.) 

Figure 3 • Dopicts a Third-Party Sender (TPS) acting as an Intermediary between an Originator 
and ODFI M 
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Banks thal initiate ACH transactions for third-party senders should know, at a minimum, for which 
originators they are initiating entries into the ACH network Thus, banks should require third-party senders 
to provide certain information on their originator customers such as the originator's name, taxpayer 
identification number, principal business activity, and geographic location Also, before originating 
transactions, a bank should verify (directly or through a third-party sender) that the originator is operating 
b legitimate business. 25 

Banks should be aleri to whether third-party senders are using more than one bank to originate 
transactions, Third parties that use multiple banks to originate ACH transactions require greater scrutiny 
before being approved to originate transactions through the bank. For example, some third-party senders 
may use multiple banks to process their transactions because they had their contract with another bank 
terminated. 

To effectively manage the risk from these arrangements, banks should have strong oversight of all third- 
party senders. Bank management should stay abreast of the ongoing flnandal condition of third-party 
senders and take timely mitigating action, such as amending exposure limits 0* requiring pre-funding, 
Bank management should establish a written agreement with each third-party sender Generally, these 
agreements 

• Outline the specific board-approved risk parameters within which the thiol-party sender must 
operate; 

• Detail the obligations and liabilities of the third-party sender. 

• Define the Information that must be provided to the bank before the thirdirarty sender can submit 
transactions for a new originator: 

• Define approved and disallowed originator and transaction types, 

• Provide the bank ongoing access to ail originators’ files; and 

• Outline the bank's nght to audit periodically such files and/or third parties so that the bank can 
verify the third-party sender's compliance with bank policies 

Bank management should also ensure that there is a process to monitor third-party senders, and should 
establish a system to audit periodically such senders to ensure that they are operating in a sound 
manner. 

Direct Access to the ACH Operator 

A bank that permits an originator or a third party (either its third-party servioe provider or an originator's 
third-party sender) to have direct access to the ACH Operator should maintain control over Its own 
settlement accounts at all times. (See Figure 4 ) To do so, a bank should enter into 0 written contract 
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with the party granted access outlining the rights and responsibilities of the parties, and include a 
provision permitting the Dank to audit the party granted access, as needed, to monitor performance and 
ensure compliance with applicable lav/s and regulations Written contracts usually include: 

• A requirement that the party granted access obtain the bank's prior approval before originating 
ACH transactions under the bank's routing number, 

• Bank-established dollar limits for hies that the party granted access deposits with the ACH 
Operator, A file that exceeds these dollar limits should be brought to the bank's attention before 
being deposited with the ACH Operator so the bank can either approve it as an exception or 
require that It be held until the next business day. 

• A provision that restricts the other party's ability to initiate corrections to files. The bank should 
implement with the ACH Operator risk-control measures that limit the correction ability of the party 
granted access. If bank management allows the other party to correct files, it should Impose and 
enforce stria controls over these corrections. Specifically, management should first authorize any 
changes to the file totals and then Instruct the ACH Operator lo release the file for processing. 

This should be a positive check-off prooess. the ACH Operator should receive the 
authorization to process a file, and failure to receive the authorization should result in the file 
being deleted. In this way. the bank has control over its exposure from files processed by the other 
party 

Figure 4 - Depicts a Third-Party Service Provider with direct access to the ACH Operator 2ft 


Processing - Agreements 



Transaction Risk 

Many banks prooess payments across different retail and wholesale payment systems for example ACH, 
credit card, debil card, check, and wire that add complexity to transaction-risk management An effective 
ACH nsk management program should be designed to coordinate with other retail and wholesale 
payment-risk management programs to mitigate total bank nsk exposure. An effective ACH risk 
management program may not reduce a bank's total risk exposure if activities are allowed to migrate to 
other payment systems. The industry has identified this additional complexity as "cross-channel ri9k." 

Information Technology 

Banks frequently deliver ACH services through a complex technology environment. Bank ACH systems 
use multiple applications, processing, storage, and communications systems that can be accessed by 
many internal and external users. Those systems may be operated by the bank, bank customers, or 
various service providers. An ACH Operator will be used for transaction clearing arid settlement. 
Moreover, many of the communications and processing systems necessary to provide ACH services are 
not unique lo those services. Effective risk management of the complex ACH technology environment 
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requires a disciplined approach to the identification, measurement, and management of technology- 
related risks. 

The FFIEC Information Technology Examination Handbook, through a series of 12 booklets, provtdes 
guidance in appropriately assessing the vanous risks associated with technology, employing effective 
strategies and controls, and monitoring and testing the provision of services to provide assurance that the 
risks are appropriately mitigated Many of the booklets are relevant to thB systems used to provide ACH 
services, and the "Retail Payments Systems Booklet" provides additional specific guidanoe related to 
ACH systems. 27 

Banks should maintain consistent and effective controls over the technology used to provide ACH 
services, especially in the key control functions of information security and business continuity. 

Information Security 

ACH-related systems, processes, and controls should be included iri a bank's information security 
program Additional, banks should ensure that their online ACH services comply with OCC Bulletin 
2006-35, Authentication In an Internet Banking Environment 26 (See also, OCC Bulletin 2006-35. 
(frequently asked questions). 20 At a minimum, the bank's information security program should address 

• Customer access • Bank management should ensure dual control and confidentiality in the initial 
setup and activation of new customers regardless of the communication channel Similarly, banks 
should secure the distribution and reset process lor any authenticators used to access ACH 
services. 

• Employee access - Banks should minimize and monitor the number of personnel with access to 
systems that support ACH services. Banks should minimize and .segregate ACH staff and limit 
nccess to various maintenance and transaction support functions (i.e.. changing account numbers, 
adding or deleting new users, changing transaction limits,). 

• Data security - Banks should ensure that sound, risk-based data security controls exist across all 
ACH-related systems, applications, and processes. Control policies and practices should address 
data in transit or storage ACH operations staff should accept data only from properly 
authenticated sources and provide a secure communication channel for all critical or confidential 
data, Banks should identify confidential or critical data used In ACH operations and ensure that 
propei storage and disposal practices are used. Key practices might indude purging data from 
online applications, encrypting data, and destroying traoe date from any med«a. 

Business Continuity Planning 

A bank's ACH activities shou'd be factored into the bank's overall business continuity plans Business 
units should ensure up-to-date assessments in light of the increased cjorporate-wide and customer 
reliance on the availability of ACH services. The business unit plans should carefully map 
interdependencies between units that support ACH services Banks should also ensure that business 
continuity lest plans are consistent with the criticality and complexity of the suppoiiing operations for ACH 
services. Some business units may need to increase the scope of their testing to ensure coordinated 
testing with other units or key infrastructure components, such as mainframe operations, network 
services, or telecommunications. 

Conclusion 

The OCC supports national banks’ participation in the ACH network to serve the needs of legitimate bank 
customers and to diversify sources of revenue. To maximize the benefits of ACH activities, banks should 
implement an effective process for managing the associated risks. The value a bank will derive from Its 
ACH program is directly proportional to the quality of the board's strategic planning and the effectiveness 
of its AC.H risk management program. 

Additional Information 

You may direct any questions or comments to the Operational Risk Policy Division at (202) 649-6550. 
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Mark L. O’Dell 

Deputy Comptroller for Operational Risk 


1 h 1 ip://wMW ffiec.gov/ff teonfobasertitml pages!it_ 0 1 i 4itof| 

3 Sec NACHA Operetmg Rules on the Internet el nttpWwwwnacho oig/c/aehiule* dm 

1 ACHA operating rules provide that originators must e»ow consumers lo opl out or ARC check conversion and establish 
reasonable procedures under which consumers may notify originators that tnor checks are not to bo convened. 

4 At a minimum, returns rates should be reviewed at the originator level for at originators 

h OCRs generaly charge back a returned ACH flahlt to the ongmetnc Out the ODF» may suffer a loss tf, fbrexiMnpto. ihn 
originator* account has (nsuihaonl funds or has boon dosed. 

6 Copyright held by NACHA Repnnled vXtfi lire permission of NACHA All lights reserved. 

7 Ongmators arc genoratty classified based on their prtnopal business activity, and in some cases their geographic location (a.g., 
some bonks may choose to ncit act as the ODFI for originators located outside of the United Stales). For adchlional Information 
on restricted merchants and risk management rotated to merchant underwriting, refer to the Merchant Processing booklet of lha 
Comptrolur's Handbook (2001 ). 

9 The SEC Code identifies the specific computer record format that vAll be used lo carry the payment and payment-related 
information 

0 Consumer debit transactions may be returned for ceiutin reasons (such as a consumer believes that the transaction is not 
authoived) through the ACH network lor up lo 60 days In addition, an OOFt*s potential lability under (he NACHA Rule* for 
breach of warranty in not Ivruiod tn tho return tree framcR, hut ts limited only by the statute of limitauins for breach of contract 
claims underapplcable law See NACHA Operations Bulletin (Mar. 28 2003), 

1(1 A troubled bomjvrer « defHed as havmg aadk rated by th* OCC as epeoai mention, substandard Coubltol, or loss, or 
adversely rated by the bank's interne! ralifig system 

* 1 Some banks may choose lo use the same «(* management po«cies and procedures they use for short-term unsecured 
(Mansion* of crodit to manage the risk associated wth morchanis and commoraal customers originating ACH ironrwcXtons 

13 RKks may include the risk of tonal kafrtty m oomoge to an msWutton'* reputation vrtion ongkiHtore or thlrd-pnrty senders 
laciUtate or engage in activities that violate oimnal laws. 

13 Fraud analysts should not rely exclusively on excessive unauthorized returns to identify fraud. Umwualy high (avals of returns 
inr other reasons (e g nonaittment funds (NSF), tnvald account, or account not found) may also be indicative of fraud for some 
iirtglnators 

14 NACHA operating gutdelnos stale Inal a reium rale ot 2 5 perwnt h> well above (no acceptable rate lor normal busmoss 
purposes. 

,a The te«m6 'thrt-pahy service pravidor" used m the Compiance section of this guidance means a thnl-paity service provider or 
a thad-party sender, or both, depending on the context 

The FFIEC's 8ank Secrecy Ad' AntFMoney L sundering Examination Manual provides additional mformaWon on BSA/AML, 
OFAC. and COO requirements for ACH transactions. 
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,fl Payment prac* snore geoemlly aw not subioct to BSA/AML regulate ry requirements. As a result, soma pioeessora may be 
vulnerable to money launduwiQ, Identity ttrafl. and fraud schemes For additional information, rater to the Third-Party Payment 
Processors section o» the FFIECs BSA/AML Examination Manual. 

:l> Additional Information nn suspicous activity monitoring and reporting systems can be found m the Automated Clearing House 
Transactions - Examination Procedure* so ebon of the FFIECs BSA/AML Examination Manual 

?< * The OOFI should also apply rnejoasad duo dihgence for domestic ACH IransucUins when the originator ,-s based n e loralgn 
country. 

21 A third-party servvea provider may transmit ACH transaction a directly la an ACH Operator wrung tho book's rowing number, 
provided I has obtained permission rrom the bank. However, the bank warrants the validity of each entry transmitted by the 
service provider, ndudaig the bew: requirement that a recover hns aulhonred each enlry 

22 For additional guidance on monnging Hurd-party rotttonshlp*, refer to OCC Butottfi 2001-47. 

M Copynght held by NACHA. Reprinted with the permission of NACHA. All rights reeurverf. 

24 Copyright held by NACHA, Repnnted wdh lira permission of NACHA All rights reservoa. 

24 Bank management should ensure lhat Iho bank’s audit proqrum checks for adlieronco lo bank policy n 1/vrd-party sondor 
«nn it garment* 

20 Copynght held by NACHA Haprtnled with the permission or NACHA All ngnts reserved. 

21 FFlEC Reifld Payments Handbook httpi/Awwr.fftoc.govf ffiebnfobase/html pagBa/retail.book Jmrne htm 
*OCC Bullo tin 200&-3D 

^OCC huNkUn 2006-35 

* References in this guidance to national banks or banks generally should be read to indude federal 
savings associations (FSA). II slatules, regulations, or other OCC guidance is referenced herein, please 
consult those sources to determine applicability to FSAs. If you have questions about how to apply this 
guidance, please contact your OCC supervisory office. 
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O Office of the 

Comptroller of tho Currency 
U,S- Dap^tma^t of Ilia Treasury 


OCC BULLETIN 2008-12 


Subject: Payment Processors To: Chief Executive Officers, Chief Risk Officers 

Date: April 24. 2008 and Compliance Officers of All National Banks, 

Federal Branches and Agencies, Technology 
Service Providers, Department and Division 
Heads, and All Examining Personnel 


Description: Risk Management Guidance 

As of October 30, 2013, this guidance applies to federal savings associations in addition to 
national banks.* 

Purpose 

This bulletin presents guidance to national banks for due diligence, underwnling, and monitoring of 
entities that process payments for telemarketers and other merchant clients As detailed in several OCC 
issuances, certain merchants, such as telemarketers, pose a higher risk than other merchants and require 
additional due diligence and dose monitoring. This bulletin supplements, but does not replace, existing 
guidance related to Automated Clearing House (ACH) risk management, merchant processing, and 
remolefy-crealed checks (RCCs). 

Background 

The OCC has seen a variety of relationships between banks and processors In which the processor uses 
its bank relationship to process payments for merchant dlents Often the processor uses a bank account 
as the vehicle to conduct such payment processing. For example, a processor may be a bank customer 
that deposits into its account RCCe generated on behalf of merchant dlents. A processor may also act as 
a third-party sender of ACH transactions, onginating debits for its merchant dients through its customer 
relationship with the bank In either case, the bank often has no direct customer relationship with the 
merchant Risks are heightened when neither the processor nor the bank performs adequate due 
diligence on the merchants for which they are originating payments. 

When a bank has a relationship with a processor, it is exposed to nsks that may not be present In 
relationships with other commerdal customers The bank encounters strategic, credit, compliance, 
transaction, and reputation risks in these relationships. Banks have tv/o distinct areas of responsibility to 
control These risks. The first is due diligence and underwriting, and the second is monitoring these high- 
risk accounts for high levels of unauthorized returns and for suspidous or unusual patterns of activity. 
Proper initial due diligence, effective underwriting, and ongoing account monitoring are critical for bank 
safety and soundness and consumer protection. Banks should implement these controls to reduce the 
likelihood of establishing or maintaining an inappropriate relationship with a processor through which 
unscrupulous merchants can gain access to consumers' bank accounts. 

Banks should also consider carefully the legal, reputation, and other risks presented by relationships with 
processors including risks associated with customer complaints, returned items, and potential unfair or 
deceptive practices. 1 Bonks that do not have the appropriate controls to address the risks in these 
relationships may be viewed as fadlitating a processor’s or its merchant diant’s fraud or other untawful 
activity. Banks should be alert for processors that use more than one bank to process payments for 
merchant dients and should subject such processors to great scrutiny. Processing through multiple banks 
may be a signal that the processor recognizes a risk that one or more of these processing relationships 
MSp/Avww nx,9CW*>aw*-isiuar*cea(tUI'Wnb/?CWS/txiiMjrv20(J6.12.lwri| 
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may be terminated as a result of suspicious, fraudulent, or other unlawful oonduct 2 
Risk Management: Effective Due Diligence, Underwriting, and Monitoring 

The OCC has provided guidance to national banks regarding relationships with processors. For example, 
banks must implement a due diligence and underwriting policy that, among other things, requires an 
Initial background check of Ihe processor and its underlying merchants to support the validity of the 
processor's and merchants’ businesses, their creditworthiness, and business practices. 3 Moreover, the 
OCC has also provided banks detailed procedures for merchant underwriting and review, as well as for 
fraud munitoring. 4 Banks should review carefully the validity and creditworthiness of alt processors and 
merchants Controls should be more rigorous for higher-risk processors and merchants (e g., 
telemarketers). Although some processors may process transactions for reputable telemarketing 
merchants, these merchants in aggregate have displayed a much higher incidence of unauthorized 
returns or chargebacks, which is often indicative of fraudulent activity. 

Due diligence, underwriting and account monitoring are especially important for banks in which processors 
deposit RCCs and through which processors initiate ACH transactions for their merchant clients. Banks 
should be alert to processors' merchant dients that obtain personal bank account Information 
inappropriately. The merchant may have misused the customer information to facilitate the creation of an 
unauthorized RCC or ACH debit file by the processor. * To ensure effective risk management, banks that 
initiate transactions for processors should require the processor to provide information on their merchant 
clients such as the merchant's name, principal business activity, and geographic location. 6 Banks should 
verify directly, or through the processor that the originator of the payment (/.©. the merchant) Is operating 
a legitimate business. Such verification could induda comparing the identifying information against public 
record databases and fraud and bad check databases, comparing the identifying information with 
information from a trusted third party, such as a credit report from a consumer reporting agency, or 
checking references from other financial institutions. With respect to account monitoring, a bank should 
not accept high levels of returns 7 on the basis that the processor has provided collateral or other security 
to Ihe bank. 

By Implementing the appropriate controls over processors and their merchant dients, a bank should be 
able fo identify those processors that process for fraudulent telemarketers or other unscrupulous 
merchants and lo ensure that the bank is not fadlilatlng these transactions. In the event a bank identifies 
fraudulent or other improper activity with a processor or a specific merchant client of the processor, the 
bank should take immediate steps to address the problem, induding filing a Suspicious Adivity Report 
when appropriate, terminating the bank's relationship with the processor, or requinng the processor to 
cease processing for that specific merchant. 

8anks are required to have Bank Secrecy Act/Anti-Money Laundering (BSA/AML) compliance programs 
and appropriate policies, procedures, and processes to monitor and identify unusual activity. Additionally, 
the FFIEC BSA/AML Examination Manual reiterates trie OCC's expectation tnat banks effectively assess 
and manage their risks with rasped to third-party processors Processors generally are not subject to 
BSA/AML regulatory requirements. As a result, some processors may be vulnerable to money laundering, 
identity theft, fraud schemes, and illicit transactions or transactions prohibited by the Office of Foreign 
Assets Control The bank's risk management program should include procedures for monitonng processor 
information such as merchant data, transaction volume, and charge-back history. 6 

Conclusion 

The OCC supports national banks* participation In payment systems to serve the needs of legitimate 
processors and the customers of such processors and to diversify sources of revenue. However, to limit 
potential risk lo banks and consumers, banks should ensure implementation of risk management 
programs that indude appropriate oversight and controls commensurate with Ihe risk and complexity of 
the activities. At a minimum, bank programs should verify the legitimacy of the processor's business 
operations, assess the bank's risk level, and monitor processor relationships for activity Indicative of fraud. 
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Additional Information 

For additional Information related to managing the risks associated with retail payment activities please 
refer to: 

• OCC Bulletin 2006-39, ACH Activities. Risk Management Guidance. 

• The "Merchant Processing" booklet of the Comptroller's Handbook. 

• OCC Bulletin 2006-13, Amendments to Regulation CC and J. 

• OCC Bulletin 2001-47, Third-Party Relationships: Risk Management Principles. 

• The "Outsourcing Technology Services" booklet of the Federal Financial Institutions Examination 
Council (FFIEC) Informal ion Technology (IT) Examination Handbook. 

• The "Retail Payment Systems" booklet of the FFIEC IT Examination Handbook. 

• The FFIEC Bank Secrecy Act/Anti-Money Laundanng (BSA/AML) Examination Manual. 

Please direct any questions or comments to the Operational Risk Policy Division at (202) 649-6550. 
Mark L O'Dell 

Deputy Comptroller for Operational Risk 


'See 15 U5C 45 See also OCC Advisory Latter 2002-3. Guidance on UqW or Deoepltva Me or Practices. 


‘See. e g , OCC BufeUn 2006-30, p.10 

*S»e the “Merchant Processing* booklet ot the Compfioijr*s Handbook, pp. 24-28. 34, The FFIEC* Bank Secrecy Atl/Ani*- 
Money Lmmdartny Examination Manual. Third Party Payment Processors, nml OCC Buketci 2006-36. pp 5. 10-11 

'See the “March nnt Processing’ booklet or (he ComptmUer’e Handbook, pp. 24-28 

* Though Ihs Merchant Procewng booklet or lha Complmher's Handbook addresses directly merchant cord aoqimng, Its 
principles and mod of the procedures outlined in the handbook are also apokcabte to the piocewlnu of other payment 
msuumenls. mdurtng RCCs and ACM transactions Soo. o.g., OCC Bulletin 200D-39. foolnote 7 and associated text 


•'Sec OCC BuBeUi 2006-3H. A background check on the pnnapal business owners supphrmane* Utn undorvuMing nt the merchant 
Otent. It a tint uncommon (or unsenjputous owners lo use mtiRlfihe busmess entities to avoid deleWon 

1 Generally, a bunk should not accept high level* of returns regaidlaesot tho return reason. Ugh levals at RCCs or ACH debits 
returned (or insufficient funds can be an Indication of fraud 


8 FFIEC BSA/AML Esamnotlon Men red, p. 210 (ThM -Party Payment Processors). See ateo OCC Bultetin 2008-39. 

* References <n this guidance to national banks or banks generally should be read lo include federal 
savings associations (FSA). If statutes, regulations, or other OCC guidance is referenced heroin, please 
consult those sources to determine applicability lo FSAs. If you have questions about how to apply this 
guidance, please contact your OCC supervisory office, 
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Financial Institution Letters 


Third-Party Risk FIL-M-200U 

Guidance for Managing Third-Party Risk Jul1 * 8 2006 

Summary the attached l-DIC gwilcncit dascrbcs poliadtal mlu soring tram 
IMrc-party rsinticosnip.'- and onlines ns* me/isgemont principles 
that (nay tie tsilcred to *ut the ooniptwJty and iWt potential of a 
financul mttlllMMrtV oiflrt«n«iot tnifO-pany ulahonsNpe. 


Highlights: 

Fi nancial instrtutions often rely upon bind IMIUU to perfcrm a wele varety a* service* and olhar activities. 
An evuiuition'* board ot directors and se reor management are ulflnvUaly raipcrulblc for marngUvg 
activities conduct ad through lt*'d-po«y rakoltomtsiK trj) idorsifyiny and centreing tins nsks nnsiftB woo* 
such retatrooshdH. to the same extent n* If Um nctlyfty Were handled wtttvn the Institution. 

Manapamonl shoiAl In** the principle* contwned u* this au-Smce to each tignitfcam |h*d -party 
arrangement, taking into consiCeraiion such factor* as ihe complexity, magnitude. and nature ol inc 
lemngoment end rwsoctotcd risks. Thrs guktnnca outline* ila potential r>st>« that may arcs him the uwt 
ot Itund parties and addrusa** the foBowing Its* basic alwiujnts of an effective tankparty ne»; 
manaioamant program 
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Mr. Bachus. And at this time the Ranking Member is recognized 
for 5 minutes. 

Mr. Johnson. If I might, Mr. Chairman, I would like to — since 
I am the only — since I am the only Democrat here, I would like to 
wait until the other Republicans have asked their questions before 
I ask my questions. 

Mr. Bachus. Mr. Marino, would you like to be recognized? 

Mr. Marino. Thank you. Thank you, Chairman. 

Thank you, Ranking Member. 

Assistant Attorney General, welcome. I am sure you did a little 
reading on us beforehand and know that my background and my 
colleague to the right, Mr. Holding — we were U.S. attorneys and 
district attorney. I was a district attorney as well. 

And there is no one here in D.C. that is more of a law enforce- 
ment guy than I am. I have the utmost respect for U.S. attorneys 
and prosecutors. I have — had a great deal of pride and still do to 
work at Justice and to be nominated. 

I do have a concern with what is taking place — what appears to 
be taking place. 

You have been the one to be chosen to be here and explain. I give 
you courage for stepping up to the plate and doing that. It should 
reflect in your review when that comes up, and I think you are 
warranted a raise. 

But, given that, “fraud” is a very vague term. And we, as pros- 
ecutors, you, as a prosecutor — we have a great deal of power. You 
probably have more power than anybody on Earth when it comes 
to investigations, whether it is civil or criminal, and we know that 
civil cases do turn into criminal cases. 

And I had the same philosophy as you do. Follow the money. I 
did it with drug dealers. I did it with organized crime. I did it with 
money laundering. 

My concern is — I want you to, if you would, please, convince me 
that this is not a witch hunt, that this is not the Department of 
Justice — let’s forget about the White House and the Administra- 
tion. 

Because I always felt the Department of Justice — although I 
worked for the President, we were and are an independent agency 
that enforces the rule of law, not politics. 

And if memory serves me right — and I looked things up and 
memory does serve me right — that there is no definition in “fraud.” 

We talk about wire fraud or security fraud. There is really no 
definition in the Federal statute. Courts have made the determina- 
tion as what the definition is. 

And just — I taught constitutional law a little bit, and I want to 
refer back to jury instructions that courts — that I have had courts 
use on describing to a jury what fraud is. 

And there is a lot more to this. But it is a general term which 
embraces an ingenious effort, all ingenious efforts, and means that 
individuals devise to take advantage of others. We, as prosecutors, 
can interpret that in numerous ways. 

Please tell me that that is not being used for political reasons. 

Mr. Delery. Well, Congressman, I can certainly tell you that it 
is not in the matters that I supervise and more broadly. 
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And I am happy to address the issues that you have raised be- 
cause I do agree with your general approach and I think that it is 
important for us to respond. 

And so I guess what I would do is point to the origin of these 
cases and how we came to pursue them and, as the best evidence 
of what these cases are about, the one that I mentioned earlier, 
Four Oaks, which was actually done in partnership with Mr. Hold- 
ing’s former district in North Carolina. 

And, you know, our policy in these cases is to investigate specific 
evidence of fraud based on evidence that consumers are being 
harmed, are being defrauded, not whole industries or businesses 
acting lawfully. 

We are holding financial institutions accountable for their own 
misconduct, for their own fraudulent conduct, not for the mis- 
conduct of anybody else. 

And so, if you look at Four Oaks, Four Oaks was a bank that 
facilitated transactions by a payment processor, even though it had 
hundreds of sworn complaints about unauthorized transactions, it 
had received warnings from NACHA, which is the electronic pay- 
ments association, it received a warning by the Arkansas Attorney 
General’s Office 

Mr. Marino. I am familiar with that, and I have followed the 
facts on it. 

But you did make a statement that — you said, “We at Justice de- 
cided to pursue these fraud cases.” 

Was it you that decided to pursue? Was it someone above you? 
Was it the attorney general or the DAG? Or did it come from the 
White House? 

Mr. Delery. So it came — it originated as a proposal from career 
lawyers in the Justice Department who had spent many years 
working on cases involving fraudulent merchants. And, based on 
that work, following the money, they noted the involvement of — 
knowing involvement of some payment processors and banks. And 
that was the genesis of these cases. And it was under my authority 
in the Civil Division that it was done. 

Mr. Marino. I think I am well over my time. We have to go and 
vote. 

But just as a prosecutor, promise me this, that we are following 
the law, that you are following the law, that these are genuine 
fraud cases that are not manipulated to look like fraud cases, and 
that we, as prosecutors, have a responsibility to focus on the rule 
of law and nothing else. 

Mr. Delery. I agree, Congressman. That has been the policy of 
these cases from the beginning and will continue to be. 

Mr. Marino. Thank you. I yield back. 

Mr. Bachus. Thank you. 

We have votes on the floor. So we will be recess — how many 
votes are there? Three votes. So we will 

Mr. Smith, you could go ahead, but I think it is — there is only 
3 minutes left on the floor. 

Would you prefer to ask a question or two? 

Mr. Smith. Could I ask quickly? 

Mr. Bachus. Okay. Go ahead. I am going to recognize Mr. Smith. 

Mr. Smith. Thank you, Mr. Chairman. 
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My question — I have two. Has anyone at DoJ voiced concerns 
that Operation Choke Point could go too far and harm entire indus- 
tries? 

Mr. Delery. Well, certainly, we have heard some of the reports 
that — you know, there have been reports in the press. We have had 
letters from Members of Congress. And we always take seriously 
the question about whether our efforts to combat fraud are affect- 
ing institutions that we are not, in fact, investigating. 

So that is something that we always are mindful of and take into 
account and review what we are doing to avoid those — those ef- 
fects, and we are doing that in connection with these cases. 

Mr. Smith. So has anyone voiced concern at DoJ? 

Mr. Delery. I think what I would say is that we have re- 
sponded — we have — we have heard the concerns that people have 
been expressed — that people have expressed and have responded by 
not only looking at what we are doing, but, also, taking affirmative 
steps to make clear to the public and to industry what our policy 
is about these cases, what we are and are not doing, so that we 
can avoid any unintended effects that go beyond what we are try- 
ing to do, which is to hold institutions accountable for fraud that 
they are committing. 

Mr. Smith. How many institutions have you all prosecuted from 
Operation Choke Point? 

Mr. Delery. So this set of cases grew out of some prior work, 
including the Wachovia case that was mentioned earlier. But of the 
ones — of the investigations that began, you know, in late 2012, 
early 2013, we have one resolution, the Four Oaks Bank case. 
There are other investigations that are still in process. 

Mr. Smith. So only one from Operation Choke Point? 

Mr. Delery. As I indicated, there are other investigations still 
in process, but only one res — one of them has been resolved at this 
point. 

Mr. Smith. Okay. You were in private practice at a private law 
firm. What is your estimate of the costs to comply with the average 
subpoenas that DOJ sent out under Operation Choke Point? 

Mr. Delery. Congressman, I don’t know what the estimate 
would be. I think that, in this context, we have sent subpoenas 
where we had reason to believe that the recipient either — the re- 
cipient had information about fraudulent conduct, either its own or 
on behalf of somebody else. 

Because sometimes subpoenas seek information, you know, re- 
lated to third parties. And, as is usually the case, we have a dia- 
logue with the recipients to discuss the scope and how the best at- 
tempts — what the best process would be for responding. 

Mr. Smith. I think it is very important that any government 
agency, any Federal agency, let alone DOJ — that if they are asking 
or requesting something out of any industry or any individual or 
any taxpayer, they better know the ramifications of their ask and 
how much it is going to cost them. And the fact that you don’t have 
any idea is very disheartening to me. 

Mr. Delery. And I think that that is something that our lawyers 
keep in mind as they are framing the — framing the subpoenas, to 
target them to the information that we need, and that is something 
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that we are — we are mindful of in this and all of the other areas 
that we pursue. 

Mr. Smith. You need to be more diligent to make sure you can 
understand how much of a financial impact your asks are going to 
have on private industry and private citizens before you start ask- 
ing. 

Thank you, Mr. Chairman. 

Mr. Bachus. Thank you. 

And at this time we will recess for votes on the floor and then 
we will return at the termination of those votes. Thank you. 

Mr. Delery. Thank you, Mr. Chairman. 

Mr. Issa [presiding]. The Committee will come back to order. 

The gentleman from Georgia is recognized. 

Mr. Johnson. Thank you, Mr. Chairman. 

This hearing appears to be in keeping with a couple of hearings 
that I have been associated with this week having to do with alle- 
gations of Presidential overreach, abuse of authority, even mur- 
murs of impeachment. And this is a hearing that is in keeping with 
the spirit of those hearings. 

One hearing yesterday, in Armed Services, the Committee ap- 
proved a subpoena for emails from Lois Lerner of the IRS. And 
then the Justice Department had a similar hearing. And so we are 
Benghazi, we are IRS, and now we are into the subject of the big 
Wall Street banking industry being singled out by this Administra- 
tion, and being singled out for persecution and criminal prosecution 
because of allegations, unfounded allegations of consumer fraud 
and other alleged offenses. 

So far, I mean, a hearing, “Guilty Until Proven Innocent? A 
Study of the Propriety and Legal Authority for the Justice Depart- 
ment’s Operation Choke Point.” Well, I have not heard any ques- 
tions about the improper use of authority, legal authority, for the 
Justice Department’s Operation Choke Point. And I have heard 
nothing about any financial service corporation being singled out 
for prosecution in the Justice Department’s Operation Choke Point. 

Mr. Issa. Would the gentleman yield? 

Mr. Johnson. Yes. 

Mr. Issa. My staff has informed us that, from the 50 subpoenas 
that were issued, only one was to a large bank and it wasn’t a Wall 
Street bank. The 50 subpoenas that we know of were issued to 
credit unions and small community banks. I just wanted make sure 
the gentleman from Georgia knew that. 

Mr. Johnson. And that is a point well taken. But I think this 
hearing has devolved into a semi-spectacle with allegations of in- 
dustry profiling, and I think we have kind of blown up some legiti- 
mate investigations and one civil action by the Justice Department 
into a misuse of authority by the President, oppressing banks. And 
this is not the case. And I am glad that my friend on the other side 
recognizes that. 

But I do want to ask you, sir, about the complaint filed against 
Four Oaks Bank. The Justice Department’s complaint against Four 
Oaks Bank is the only civil action against any party as a result of 
Operation Choke Point. Isn’t that correct? 

Mr. Delery. Yes, Congressman, it is one that has been filed. 
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Mr. Johnson. And this is a community bank, or a regional bank, 
or a large commercial bank. 

Mr. Delery. Well, Four Oaks, I would say, I am not sure how 
to define it, it is probably regional, is how you would explain it. But 
I think one of the things that the evidence that we found, as re- 
flected in the complaint, demonstrates is that an institution like 
that can process a very large number of transactions, more than 9 
million for a single payment processor at $2.4 billion. So the num- 
bers that we are talking about can be very large. 

Mr. Johnson. And in the complaint filed against Four Oaks 
Bank under FIRREA by the Department of Justice, the United 
States of America alleged that the bank “knew or was deliberately 
ignorant of the use of its accounts and its access to the national 
banking system in furtherance of a scheme to defraud consumers,” 
end quote. Although this complaint was settled, how would a court 
construe this actual fraud under FIRREA? 

Mr. Delery. I think if you look at the detailed allegations in the 
complaint, there was clear evidence of widespread information that 
the bank had about fraudulent transactions that it was processing. 
That information came from a number of categories, including com- 
plaints, sworn complaints by customers who had been victimized, 
by warnings from a State attorney general and from another orga- 
nization, had evidence that one of the merchants was attempting 
to hide its identity, and it had very high return rates for more than 
a dozen merchants that were more than 30 percent — one was more 
than 70 percent — which, again, is a strong indication of fraud. 
Bank officials knew this information and, according to the com- 
plaint, continued to process it anyway. And that was the basis for 
the FIRREA action in that case. 

Mr. Bachus [presiding]. Thank you. 

Mr. Johnson. Well, now you didn’t sue Four Oaks Bank because 
it provided services to high risk merchants, did you? 

Mr. Delery. The basis for the action was that the bank knew, 
knowingly facilitated, and in certain circumstances turned a blind 
eye to evidence that it had of fraud. So I do think that this case 
is a good example of the work that we are doing, which is to hold 
banks accountable for their own unlawful conduct under existing 
law. 

Mr. Bachus. Thank you. 

Mr. Johnson. Well, as a taxpayer I want to thank you for doing 
that. 

And I will yield back. 

Mr. Bachus. Thank you, Mr. Johnson. 

At this time, I recognize Mr. Issa. 

Mr. Issa. Thank you, Mr. Chairman. 

Thank you for being here today. I have got a number of ques- 
tions. 

First of all, I would ask unanimous consent that the subpoena 
dated May 20, 2013, from the Department of Justice Consumer 
Protection Branch be placed in the record at this time. 

Mr. Bachus. Without objection. 

[The information referred to follows:] 
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Joel Sweet 

Mmn« 202-5J2-4tiftJ 
F.rt- m-i H -8742 


U.S. Department of Justice 

Consumer Protection Branch 


Overnight Deliver y Address Mniling Address 

450 Htlll Strati. NW, Si»Ui Floor Sollll. P O. Ho* 3#<t 

WadnnRliHi. 1>C root) I WushtnuU*. D C, 20<I44 


VIA CERTIFIED MAIL 




RE: Consumer Fraud Investigation 



Enclosed is a subpoena requiring the production of documents in connection with 
an investigation of consumer fraud. We look forward to your cooperation with our 
investigation. 


For your information, also enclosed is regulatory guidance concerning risks posed 
to banks and consumers by third-party payment processor relationships. See Risk 
Associated with 'ITurd-Party Payment Processors (FIN-201 2- A010) (October 22, 2012), 
Payment Processor Relalionships-Revised Guidance (FDIC FIT, -3-201 2) (January 3 1 . 
2012), and Payment Processors-Risk Management Guidance (OCC-2008- 1 2) (April 24, 
2008). 


If you have any questions, please contact me at 202-532-4633, or Trial Attorney 
Josh Burke at 202-353-2001 . 



Enclosures 


ce: Josh Burke 
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l).S, Department of Justice 

Civil Division 


iJlJln' at till lialSM/il Altar ncy Gmemt 


U’othlngloil DC 20530 


SUBPOENA DUCKS TECUM 
FOR THE PRODUCTION OF DOCUMENTS 




This subpoena is issued pursuant to 12 U.S.C. § 1 833a(g)(l) in the course of an 
investigation to determine whether there is or itas been a violation of one of the provisions of 
Title 1 8, United States Code, enumerated in 1 2 U.S.C. § 1 S33a(c). 

You are hereby required to produce all documentary material described in Exhibit A 
attached hereto in accordance with the attached definitions and instructions thut is in your 
possession, custody, or control, and to make it available at 450 Fifth Street. NW, 6' 1 ’ Floor South, 
Washington, DC 20001 , for inspection and copying or reproduction, Such production shall 
occur on or before June 14,2013. In lieu ol’produclion, you may deliver the documentary 
material to Postal Inspectors Jan Bodon and/or Edward Kljunich, Department of Justice, at the 
address set forth below. 

The production of documentary material in response to this subpoena must be made 
under a sworn certificate, in the form set forth, by a person or persons having knowledge ol the 
facts and circumstances relating to such production. 

Inquiries concerning compliance with this subpoena should be directed to: 

Jan Bodon and/or Edward Kljunich 
U.S. Postal Inspectors 
US, Department of Justice 
Consumer Protection Branch 
45(1 Fifth Street. NW 
6"' Floor South 
Washington, D.C. 20001 
202-514-0514 

Date: K 


Acting Assistant Attorney General 
Civil Division 







82 


EXHIBIT A 


I. 

INSTRUCTIONS 


A. Documents sought by these requests shall include documents within your 
knowledge, possession, custody or control, or within the knowledge, possession, custody or 
control of any of your agents, officers, employees, attorneys or investigators, or any person 
acting as your representative, including, hut not limited to. any otherwise independent 
accountants or consultants. 

B. The fact that some portion of the documents responsive to these requests may 
already be in the custody of the United States or a United States agency docs not excuse 
compliance with this subpoena. 

C. If the Company withholds any document on the ground of any privilege, il shall 
provide a statement setting forth: 

(a) the name and title of the author (and, if different, the preparer and signatory); 

(b) the name and title of tire person to whom tire document was addressed; 

(c) the names and titles of all persons to whom the document or a copy of the 

document was sent or to whom the document or a copy, or any part thereof) was 

shown; 

(d) the date of the document; 

(c) the number of pages; 

(f) a brief description of the subject matter; 

(g) the nature of the privilege claimed; and 

(h) the paragraph of the schedule of documents to which il is responsive. 

D. No document called for by this subpoena shall be destroyed, modified, redacted, 
removed, or otherwise made inaccessible, except insofar as documents rue withheld under claim 
of privilege in compliance with the instructions above. 

E. If the Company has knowledge of any document that would be responsive to this 
subpoena schedule but Iras hecn lost, destroyed, discarded, or subject to removal or alteration, it 
shall identify to the extent pnssible each such document and provide art explanation of the loss, 
destruction, discarding, removal, or alteration (including identification of each person 
authorizing or having knowledge of tire loss, destruction, discarding, removal, or alteration). 
Selection of documents from files and other sources shall he performed ill such a manner as to 
ensure that the source and original location of each document may be readily determined. 
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F. File folders and other containers in which you find documents responsive to these 
requests, and labels identifying those folders and other containers, shall be produced intnet with 
such documents. 

0. I'hc attached ’'Specifications for Production of ESI and Digitized (Scanned) 
Images” apply to your production of electronically stored information. 

II. Documents must be produced in the same internal order in which they are found 
in your company's files. Documents that are found stapled, clipped or otherwise fuslened 
together, or in file folders or other enclosures, must be produced in such form and in such folder 
or enclosure. Documenls that are grouped 01 organized under a single classification or within an 
individual's selection of files must be produced as a whole without separation, irrespective ofthe 
number of distinct paragraphs of this subpoena to which such documents may be responsive. In 
addition, the name of the person from whose files each such document was produced must be 
identified. 

1. These requests arc continuing in nature. You are thus required to amend your 
responses to these requests and to supplement your production if you learn that your prior 
responses and production are incomplete or incorrect. 

J. Tile Department of Justice ofien makes its files available to other civil and 
criminal federal, state, local, or foreign luw enforcement agencies. The Department may make 
information supplied by you available lo such agencies. Information you provide may he used in 
any federal, state, or foreign civil or criminal proceedings by the Department or other agencies. 

K. Unless otherwise directed ill the specifications, the applicable time period for the 
request shall be from .Ian nary I, 2009, through the date of your full and complete compliance 
with this subpoena. 

L. You shall retain all documentary materials used in the preparation of responses to 
the specifications of this subpoenu. Die Department of Justice may require the submission of 
additional documents at a later lime during this investigation. Accordingly, you sliuuld suspend 
any routine procedures for document destruction and take other measures to prevent the 
destruction of documents that are in any way relevant to this investigation during its pendency, 
irrespective of whether you believe such documents are protected from discovery by privilege or 
otherwise. 

M. If you believe that the scope of the required search or response for any 
specification can be narrowed consistcnl with the Department of Justice’s need for documents or 
infomiation, you are encouraged to discuss such possible modifications, including any 
modifications of definitions and instructions, with Trial Attorneys Joel Sweet at 202-532-4663 or 
Josh Burke at 202-353-2001 , Any such modifications must be agreed lo in writing. 

N. Because postal delivery to the Department of Justice is subject to delay due to 
heightened security precautions, please use u courier service such as FedEx or UPS. Notice of 
your intended method of production should be given by telephone lo Joel Sweet at 202-532-4663 
at least five days prior lo the return date. 
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O. All document requests should be responded to in accordance with the Instructions 
and Definitions provided herein. 


U. DEFINITIONS 

A. The word “document - has the- same meaning as it does in Federal Rule of Civil 
Procedure 34(aXIXA), and is intended to be interpreted broadly to include electronically-stored 
information. 

B The terms “you,” “your,” and “Company” refer to Four Oaks Bank & Trust Co. 
and include corporate predecessors, merged predecessor corporations, parent corporations, past 
and present subsidiaries and affiliates, as well as current and former directors, officers, 
principals, partners, employees, agents, representatives, or other persons acting for or on behalf 
thereof, including, but not limited to, any otherwise independent accountant, investigator or 
consultant, 

C. The temis “concerning,” "relate to,” “related to,” and “relating to,” mean 
discussing, describing, reflecting, embodying, memorializing, containing, constituting, including, 
identifying, stating, studying, reporting, commenting, evidencing, analyzing, setting forth, 
considering, recommending, concerning, or pertaining or being relevant to. in whole or in part. 

D. The use ofa singular shall be construed to include the plural and use of the plural 
shall be deemed to include the singular. 

E. The words “and” and “or" shall be construed both conjunctively and 
disjunctively, as necessary, in order to bring within the scope of any specification of the 
document requests all information that otherwise might be construed to be outside the scope of 
the specification. 

F. the words “any" shall be construed to include the word “all," and the word “all” 
shall be construed to include Ihe word “any.” 

G. The word “each” shall be construed to include Ihe word “every,” and “every” 
shall be construed to include the word “each.” 

II. The term “person” means any natural person, corporation, company, partnership, 
proprietorship, joint venture, firm, association, or other form ofbusiness or legal entity, and 
includes any affiliate, subsidiary, employee or representative thereof. 

I. The terut “Payment Processor” means and entity that performs any function of 
collecting, formatting, charging, originating, transmitting, or processing a consumer's payment 
for goods or services directly or indirectly through the use of any payment mechanism, including 
but not limited to the processing of Remotely-Created Check (“RCC") transactions, Remotely- 
Created Payment Order (“RCPO”) transactions, automated clearing house (“ACH”) transactions, 
mobile payments, and credit card transactions. 

J. “Sale” means any sale, offer for sale, or attempt to sell, any goods or services to 
consumers for consideration. 
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K. The term “Mcrchant-CJient” means any business or entity engaged, or purportedly 
engaged, in the Sale of goods or services directly or indirectly to consumers and that 
communicates with consumers using the Internet, telephones, or United States Postal System. 

! The term “Remotely-Created Check" (“RCC”) means a check that is not created 
by the paying bank and that docs not bear a signature applied, or purported to be applied, by the 
person on whose account the check is drawn. For purposes of this subpoena, the term RCC 
includes "demand drafts,” “bank drafts," “bank checks," and “preauthorized drafts." For 
purposes of this subpoena, RCC specifically includes Rcmolcly Created Payment Orders 
("RCPO”). The term “account" as used herein is defined in Regulation CC, Availability of 
Funds and Collection of Checks, 1 2 CFR 229, 2(a). as well as a credit or other arrangement that 
allows a person to draw checks that are payable by, through, or at a bank. 

M, The term “Return” means any attempted debit transaction against a consumer's 
bank account that has been relumed by the consumer’s bank or the bunking or payment system 
for any reason. For purposes of this subpoena, the term “Return" has the same meaning as a 
"chargeback." 

N. “Return Rate" means the proportion (expressed as a percentage) of Return 
transactions relative to the total number of transactions originated for a given time period 
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ni. DOCUMENT REQUESTS 

1 . Documents sufficient to identify all Payment Processors for which you fiavc originated 
RCC, RCPO, or ACH debit transactions against consumers’ bank accounts. 

2. Ail agreements (including all writings memorializing business terms) between you and 
all Payment Processors on belmlf of which you originated RCC, RCPO, or ACH debit 
transactions against consumers’ bank accounts. 

3. Documents sufficient to identity the respective owners and addresses of all Payment 
Processors on behalf of which you have originated RCC, RCPO. or ACH debit 
transactions against consumers’ hank accounts. 

4. Documents sufficient to identify Payment Processors and/or Merchant-Clients that 
experienced q Return Rate of three (3) percent or greater in any one-month period. 

5. For Payment Processors and Merchant Clients for which you have originated RCC. 
RCPO, or ACH debit transactions against consumers’ accounts and that experienced a 
Return Rate of three (3) percent or greater in any one-month period, the complete due 
diligence file for that that entity and all of its customers (including but not limited to C1P 
information and documents identifying prior financial institution relationships). 

6. For Payment Processors and Merchant Clients for which you have originated RCC!, 
RCPO, or ACH debit transactions against consumers’ accounts and that experienced « 
Return Rate of three (3) percent or greater in any one-month period, all Return 
summaries, databases, und/or reports. 

7. All communications between or among you and: (a) any regulatory agency; (b) any law 
enforcement agency; (c) any financial institution; and/or (d) any consumer, concerning 
allegedly unauthorized debit transactions relating to Payment Processors and Merchant- 
Clients for which you have originated RCC, RCPO, or ACH debit transactions against 
consumers' accounts. 

N. All communications between or among you and Payment Processors and Merchant- 
Clients for which you have originated RCC, RCPO, or ACI1 debit transactions against 
consumers’ accounts concerning: (u) Returns; (b) inquiries by law enforcement or 
regulators; (c) consumer complaints; (d) allegations of fraud; and/or (e) allegations of 
unauthorized transactions. 

y. Organizational charts reflecting your departments) responsible for: (a) managing your 
business relutionship(s) with Payment Processors; and (b) addressing complaints of 
unauthorized or fraudulently induced debit transactions against consumer bank accounts. 


6 



87 


CERTIFICATE OF COMPMANCE 


I/Wc do hereby certify that a diligent search of the documentary material called 
for by the subpoena issued pursuant to 12 IJ.S.C. § 1833a(g)(!) has been made, and that all of the 
documentary material in the possession, custody or control of the person or entity to whom the 
subpoena is directed has been produced and made available at tile time, place and manner 
specified. A list identifying all ofthe documents produced is attached. 

Any documentary material otherwise responsive lo this subpoena which has been 
withheld from production under a claim of privilege or for any other reason has been identified 
herein by (I) the date of the document, (2) the authors), (3) the addressee(s), (4) die recipient^), 
(5) the title, (6) the subject matter, (7) the purpose of the document, (8) its present custody, 

(9) such olher information as is sufficient or necessary lo identify the document, and (10) the 
nature of the privilege claimed. Any such withheld documentary material will be preserved until 
wc receive notice from the United States Department of Justice that the investigation in 
furtherance of which the subpoena has been issued is no longer pending. 


Signature 

Title 

Sworn to before this 

day of 

Nolary Public 

My commission expires: . 


7 
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UNITED STATES DEPARTMENT OF JUSTICE 
CERTIFICATE OF COMPLIANCE 
WITH THE RIGHT TO FINANCIAL PRIVACY ACT OF l‘»78 


TO: 



FROM: Joel Sweet 

Trial Attorney 

U,S. Department of Justice 

Consumer Protection Brancli 


To the extent that the records sought by the accompanying subpoena are subject to the 
Right to Financial Privacy Act of 1*178 (“RFPA"), 12 U.S.C. §§ 3401 to 3422, because the 
exception set forth in 12 U S.C. § 3413(h)(1)(A) applies here given that this investigation is 
directed at financial institutions, I hereby certify that the applicable provisions of the RFPA have 
been complied with as to the sub|ioen» issued by die Department of Justice pursuant to 1 2 U.S.C. 
§ 1 833a(g)( I ) and as to subsequent subpoenas issued to you and requests for information from 
you in this matter. 

Pursuant to the RFPA, good faith reliance upon this certificate relieves you and your 
employees and agents of any possible liability to the customer in connection with the disclosure 
of these financial records. 



DATE: 


By: 




89 


\':rr*mtrr 2ti I i 


Specific Hi ions lor Production of ESI and UigKi7.nl r‘Sea«necV v ) Images 
(“Production Specifications*’) 

Collection of Electronically Stored Information (F.SI) 

Care fill consideration should he given ui the methodology, implementation and documentation uf ESI collection to ensure 
thtu all nisjamaive data tuvd metadata are preserved in the collection process. 

1, Specification Mmlificnliniis 

Any incxlificmionsor deviations from the Production Specifications may be done only with the express 
permission o! Ihc government. Any responsive data or documents tlwt exist in localions or native form? 
not discussed in these Production Specifications remain responsive and. therefore, arrangements should 
he made with the government to facilitate ilieir production. 

2. I'roductioti Formal of FSI and Ltnuged Hard Copy 

Responsist* ESI ttnd imaged hard copy shall be pi educed In the fanout outlined below, All ESI, except as 
outlined below in sections 9-19, shall be rendered to type TIW image format, and accompanied In a 
Concordance® Image Cross Reference file, All applicable metadata (see section 3 below) shall be extracted and 
provided in Concordance® load file Format 

a. Image! File Formal: All images, paper documents scanticd to images, or rendered ESI, .shall be produced 
os 300 dpifi ingle-page I IFF files, CCNT Croup IV (20 Compression). Documents should he uniquely and 
sequentially Bales numbered with ah endorsement burned inlo each image. 

• All TUT file names shall include the unique Bates number burned trno the image. 

• Each Bates mini her shall be a standard length, iucludfc leading zeros iu the number, and be unique for each 
produced page. 

• All TIFF image files shall be slorod with the “.riT extension. 

• Images shall be OCR'd using n standard COTS produelb. 

• All pages of a document or all pages of a collection tif documents Ifvat comprise n folder or other logical 
grouping. Including n box, shall be delivered on a single piece of media. 

• No ituage folder shall contain more limn 2QU0 images. 

b. CimiOrdam*'® Image Cross Reference file: Images should be accompanied by a-Concnnl.inrc^1m:igc 
Cross Reference file that associates each Bates number with its corresponding single-page TIFF image file. The 
Cross Reference file should also contain the image file path far each Bates numbered page 

• Unuuc Cross Reference Sample format: 

ABCOOUOOOOl.OJ . S, Dh DatalxiM' NanfcAl i tiage-sAflO I \ ABCOOOOOUDU IE,Y M . 
ABCOWI[KXHI2,DLS.l):\l>JtJibascNmneVlmBgw)001 \ ABCOU000002. Ilf.... 

ABCUM00003.O1 .S % D:\DnmbiiscN.imc\lmage.sVj01 \ AliC00000003.TIF,,,. 

ABC00000004.01 ,S ,D:Vf> irtahiiseN aiueM magcs\00 1 \ A.BCOW00004 T1F.Y.., 

c. Concordance® Load File: Images should also he accompanied by a “text load file" containing delimited 
text that will populate fields in a searchable, flat database environment. The file should contain the required fields 
listed below in section 3. 

• ASCII text delimited loud files lire defined using Ihc fallowing delimiters. 

Field Separator A or CvJe OSH 

Text Qwilijiar | or Co4t J 24 

SitbslilMti Oavfayv Return or FW Line () or Coifc 015 


\ 
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Specifications for Production of RSI and Diglli/xd (‘'Scanned”) I mages 
("Production Specifications*’) 

• five text Hie should also contain hyperlink* to applicable native files, such as Microsoft Excel or 
PowerPoint files. 

• There should l>c one line for every record in n collection. 

• The load die must contain a field, map/kev listing the mclndatrvdaiahosc fields in llu* oulei tlvcy appear 
within die data file. F 01 example, if the dnta life consists of a First Page of a Record (smiling Holes). ! ast 
Page of a Record (ending Bales). Document ID, Document Dote. File Name, and a Title, ihenihe structure* 
may appeal tvs follows: 

|BFGDOCW;'‘|l£NDDOCV/nDOClD{'iDOCDA1T:riFlL.ENAMF(''niTLEj 

• Tlvc extracted' OCR text for each document should be- provided as a separate single text flic. The file name 
should match the BEGDOCtf or DOC1D for that s|iccific record and be trccampuriicd In the . 1 x 1 extension. 

3. Required Metadafu/Datatutse Fields 

• A 1 / * denotes; dun tire indicated field should he present in the load file produced. 

• “Other FiST includes non email or hard copy documents, including hill not litniicd to duln discussed in 
sections ft-U, and I?.* 19 below. 


Field mime 

■ - - ' 

Field Description 

Held 

Type 

Field Value 

k,: 

HnrO 

Copy 

K- 

Mnll 

Other 

ESI 

COMP AN V 

PS "T| ~ 

Full 

Text 

m 

m 

m 

EH 

BOX# 

SulmiisMon/volume/box number- 

BmSI 

E5yMi 

UHH 

m 

m 

EH 

CUSTODIAN 

Cus1odian(sySourcc(3) - formal: 
Lust, l ira or ABC Dent 


m 

m 

✓ 

AUTHOR 

Creator of tire document 

Nolc 

Text 

160 

m 


/ 

BEGDQC* 

Swn Bates (including prefix) * 

No spaces 

Note 

Text 

60 



EH 


End Buies (including prefix) - 
No spaces 

Note 

Text 

60 

/ 

/ 

EH 


iKlil 

Note 

Tout 

6U 

/ 

y — 

✓ 

PCiCOUNT 

Page Count 


10 

/ 

✓ 

y 

PARE NT! D 

-Parent's DOC ID -or Parent's Start 
Bales (for EVERY document 
including aU Child documents) 

Note 

Text 

60 

m 

/ 

/ 

ATTACH IDs 

Child document list; Child 

IX)ClD or Child Start Bates 

MtlJli- 

Enlrv 

lo 

m 

/ 

m 

AlTACIfL 1ST 

List of Attachment Bales 
number? 

P^ii 

Unlimited 


m 

m 

B15GATTACH 

Start Bates number of first 
attachment 

Note 

Text 

60 

s 

m 

m 

KNDATTACH 

Eud Bates number of last 

EsaHi 

60 


warn 

ram 












































SUBJECT 
CON V INDEX 


I DOCJMTE 


j BODY 
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[reifications for Production of ESI anil Digitized (“Scanned”) images 
(“Production Specifications”) 


- 

Field Description 

Field 

Type 

Field Value 

Hurd 

Copy 

K ‘ 

JVXnll 

Ollier. 

ESI 


j H 

Tcxl 



HHI 

■MM 


Privilege notation!*. Redacted, 
Document Withheld Based On 
Privilege 

Miflti- 

Entry 

Unlimited 

■ 

■ 

■ 


Pile, E-mail. Attachment, or 

Hard Copy 

Note 

Taxi 

60 


IB 


Author - format; Last name, First 
name 

"Note 

Text 

160 

m 

m 

/ 

- 

Recipient- format: Last name. 

First name- 

Multi- 

Entry 

Unlimited 


M 

✓ 

Ciirhou Copy Recipients - 
format: Last mime. First name 

at , 

Unlimited 


/ 

/ 


Blind Carbon Copy Recipients - 
formal: Last name, First name 

EJ23B 

Unlimited 


m 

/ 


Suhjcct/Documcnt Title 

Note 

Text 

Unlimited 



/ 


E-moil system ID used to track 
icplies, forwards, etc 

Note 

Tcxl 

Unlimited 

S 

/ 


Document Date/Date Sent - 
Format YYYY/MM/DD 

Date 

Keyed 

YYYY/MM/DD 



./ 



Full 

Text 

Unlimited 

/ 

/ 

« 

/ 


Time e-moil was sent 

' MM 


warn 

H 



Date Curated 

523H 

YYTY/MM/DD 

MV 

ram 

/. 


Dale Saved 

i-ZJB 

YYYY/MM/DD 


um 

/ 


Date Last Modified 

Dale 

Keyed 

YYYY/MM/DD 


✓ 

/ 


Date .Received 

E23B 

YYYY/MM/DD 


/ 



Dale Accessed 

CSDBI 

YYYY/MM/DD 


/ 

/ 


File Size 

Note 

Text 

10 



/ 



Fun 

Texi 

Unlimited 



✓ 


Application used to creole native 
tile (c.ja.. Excel, Outlook. Word) 

Note 

Text 

160 


■7 

/ 


Extension lor the file (e.g. doe; 
.pdf; .wpd) 

Note 

Text 

10 

■ 

/ 

s 


Date's original source full folder 
path 

Full 

Text 

■■v. 

5 

/ 

/ 


gmim 

Full 

Text 



/ — 

S 


laMMMfelMM 

Full 

Text 

Unlimited 

✓ 

/ 
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Sped Honda ns for Production of ESI and Digitized (“Scanned”) images 
(“Production Specifications”) 


Field name 

Field Description 

Field 

Type 

Field Value 

Hard 

Copy 

E- 

Mnll 

Other 

ESJ 


Polder or hi niter name*) 






PARAGRAPH 

Stibpocnu/rcqucM paragraph 
number to which the document 

MulU- 

Eniry 

Unlimited 

/ 

/ 

/ 

HASH 

Hash value (used for 
deduplication or utlwr 
processing) (e-mail hash valinis 
must be run with the e-mail and 
all of its attachments) 

Note 

Text 

Unlimited 

fl 

/ 

/ 

MESSAGF.HEADEK 


Full 

Text 

Unlimited 


/ 


A'!TA CHMCOUNT 

Number ol attachments to an 
email 

Note 

Text 

10 


/ 


riLEim 

Identifies the application that 
created the flic 

Note 

Text 

1*0 


/ 

/ 

COMMENTS 

Identifies wJvcthcr the document 
has comments associated with it 

Note 

Texi 

10 


/ 

V 


4. Dc-duplfention, Nenr-Dupflcato I den fi flea (ion, Email Conversation Threading and Office Culling 
Procedures 

Dc-dnpllcMion of exact copies within H custodiun's daia may be done, inn nil , *nicpailrc" must be provided for each 
duplicate document. The recipient slrall not usc.tmy oilier procedure to cull, filter, gronp, separate or de-duplicate, 
etc. (i.e , reduce the volume of) responsive mmcrlal-belbrc discussing with and obtaining the written approval of 
Ilie government. /Ml objective coding (o.g„ near dupe !D or e-mail tlircnd ID) shall be discussed and produced to 
the government as additional metadata fields. 

5. Hidden Text 

All hidden text (c.g. track changes, hidden columns, mark-ups, notes) shall be expanded ami rendered in the image 
file, Em files that cannot k expanded the native files shall be produced with die imago file. 

6. Embedded Files 

All non-graphic embedded objects (Word documents. Excel spreadsheets, .wav files, etc.) tb:il arc found within a 
file shall be extracted and produced l ot* purpose* or production die embedded tiles shall be treated as attachments 
to the original file, with the pnrent 'child relationship preserved. 

7. Image-Only Files 

All image-only files (non-scurohnbie .|xffs, multi-page 'PJEPs, Snipping Tool (and otkrj screenshots, etc., hs well B3 
all other imaged Uiat contain text) shall be produced wtflt associated OCR text tmd motadma'dnlabast* Helds 
identified in scClion3 for "Other ESI." 

S. Hard Copy Records 

a. All hard cop) material shall reflect accurate docimicnt unitization Including all attachments and combiner 
Infwtnalior) (io be reflected in the PARENT1D. ATTACI IID, BEGATTACH, ENDATTACH and f Ol.DER ID). 
Unitization in this conlexl refers to identifying and marking the boundaries of documents Within the collection, 
where a document is tie lined ns tire smallest physical fastened unit within a bundle, (c.g.. staples, paperclips, 
rubber bands, folders, or tabs inn binder.) The first document in the collection rcjiresents the parent document 
and all other documents will represent the children. 


4 
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Specifications for Production of ESI anti Digitized (“Scanned") Images 
(Trodiicttnn Specifications'') 

h. All documents shall be produced in black and while TUT formal unless the image requires coloi An image 
"requires color" when color in the document adds emphasis to information in the document or is Itself 
infonmtion that would not be readily apparent on tin? lace of a black and while image. Images Identified as 
requiring color shall he produced tis color 300 dpi single-page JPEG files, 
c. All objective coding (ex... document date or document author) should be discussed and produced lo ilic 
government us additional meiadnfrvdaiabase fields. 

•). Production nf Spreadsheets arid Presentation Files. AIJ sprusdshccl and presentation files (c.g. Excel, 

PowerPoint) shall be produced in the unprocessed "us kepi in the ordinary course of business" stale (lc-. in native 
formal). See section 1 8 below, The file produced should mainlrdn the Integrity of all source, custodian, 
application, embedded and related file system metadata. No alteration shall be made to file names « extensions 
for responsive native electronic files. 

Hi. Pit)duc1ion of Email ft epoxil uric* 

limiiil repositories, also known as email databases (c.g , Outlook PST. Loins .MSI*, etc.), can contain n variety of 
items, including: messages, calendar), contacts, (asks etc. l ; or purposes of production. responsive items shall 
include lltc •‘Email*’ metadma/duluba* field* outlined in section 3. including but not limited to all patent items 
(mull, tnlcndtir, contacts, husk*. notes, etc.) and child files (allaclnncnu, nf. files to email or other items) with the 
parent /clvild relationship jiwsstjived, Email databases from operating systems ot hen him Microsoft Exchange shall 
lie piodtK-ed altar consultation with ami written consent of the government about ilia format fn; the production of 
Midi dal abuses. 

1 1 , Production of Items Originally Generated in K-Mnil Repositories but Pound and Collected Outside of 
Email Repositories, i.e., "Siand-ftlcmc-” Hems 

Any parent email or other parent items (e.g. f calendar, contacts, tasks, notes, etc.) fount! and collected outside ol 
enroll repositories (c.g.. Items having extensions like .MSCi. .HTM. MHX. etc,), shall be produced hums with tbs 
'‘Email" metadata fields outlined in section 3, including hut not limited to any attachments, maintaining die fnmijy 
(panenl/cltfld) rclutionshlp. 

12, Proiludion of Instant Messenger (IM), Voiewnuil Dutu, Audio DtM, Video Data, etc. 

TIk' responding party shall identify, collect, and produce tiny mid all Jala which is responsive to the requests 
which may be stored in audio or video recordings, cell phonc/l’DA/Uludbcrry/smnri phone data, tablet dutu, 
voicemail messaging data, instant messaging, text messaging, conference call data, vidco.toudio conferencing (c.g. 
CioTo Meeting, WebEx), and rclaicdVmiilar technologies. I Iomvvct. swell data, lugs, metadata or otlicr files 
related thereto, ns well as other lew common but similar dnta types, shall be produced alter consultation w ith imd 
written consent of the government about the format for the production of such data. 

13, Social Media 

Prior to any prwfuofiwi of responsive data from Sue Ini Medio (e.g, Twiner, PaccbooL Google*. Linkedln, 
ctcjlhc producing party sluill first discuss with the government the potential export formats before collecting the 
Information. 

J 4. Productions of Structured Data 

Prior lo any production of responsive data from a sti uctured dm abase (eg., Oracle, SAP. SQL. MySQl., 
QuiekDoolis. etc.), the producing party skill first provide the database dictionary and u list of till reports that cun 
be generated from tire sitrueuircd daUiiw.se. The list of reports shall be provided in null ye Excel (.xls) format. 

J5. Productions of Structured Data from Proprietary Applications 

Prior to any production of structured data from proprietory applications (e-tL, proprietary timekeeping, 
accounting, sales rep cull notes, CRMs. ShnrePoint etc.) the producing pony shall fust provide Hie dniabnsv 

5 
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-Specifications for Production of ESI and Digitized (“Scanned 1 ’) Images 
(“Production Specifications*’) 

dictionary nnd n Hsiuf nil icfxnls can be generated from the simeuued database The list of reports. ‘.hnfl be 
produced in native Kxecl (.xls) formal. 

16. Production of Photographs wit li Native File or Digitized KSI 

Pholograplts sirall be produced ns single-page ..IPG flies with a resolution equlvidem 10 the original Image as it 
was cnplured/crenlcd. All JPG flics sluill have extracted motadam'riatnbose fields provided in a Concdfdadoo& 
load file format as outlined In section 5 lor “Oilier fiS’l." 

17. Images from which Text Cannot lie OCR Converted 

Au exception report shall be provided when limitations of paper digitization saftwnre/ltardwure or attribute 
conversion do not allow Tor OCR text conversion or certain images. The report shall Include die okict funic Utiles. 
Document Id or Bales uumbcr(s) corresponding to each such image. 

I R. Format of E.S*l from Non-PC or Windows- based Systems 

If responsive ESI is in non-PC or iiorvWiiulowK-hasscd Systems (e.g.. Apple, IBM main frames, and UNIX 
machines), the ESI shall be produced a(W discussion with and written consent of the government about ilia 
format fur the production of such data. 

19. Production of Native Files (When Applicable Pursuant to These Specifications) 

Productions of native files, us called for in flwse specifications, shall have extracted mcindolaJatateise fields 
provided in ti Concordance® load file format nx defined in the field sped fictitious for “Othei HSI" us outlined in 
section 3. 

n BS1 shall b© produced in a maimer which Is runctionnlly useable by tire government. The following are 
examples: 

• AuioCAD dam. c.g.. .DWG, .DXP, shall be processcd/converted und produced ns single-page 
.JPG image files and accompanied by a Concordance® Image formatted loud n> described above. 
The native files shall be placed in n separate folder on tlte production media and linked b> a 
hyperlink within lire text loud file. 

• OIR data shall be produced in its native format and be accompanied by a vlexvcr such that the 
mapping or oilier data can be reviewed in a manner that does not detract from its ability to be 
reasonably understood. 

• Audio and Video recordings shall In* produced in native fonnat and be accompanied by n viewer If 
such recordings do not play in n generic application fe.g„ Windows Merlin Player). 

20. Bates Number Convention 

All images slimild In* assigned Bales numbers before production to the government. The numbers should be 
•‘endorsed" Cor ‘‘burned in“) on tiic actual images. Native files should be assigned n single bales number for the 
entire file Hie Bales number shall not exceed 30 characters in length and shall include leading zeros in lire 
numeric portion. The Bates number shall be n unique natne/number common tu each page (when assigned to an 
Image) or lo each document (when assigned U> o natlxx file). If the government agrees to a rolling production. tire 
naming'nuinbcriug convention shall remain consistent tlirouglKM the entire production. There shall be no spaces 
between the prefix and numeric value. Ifsuffixcs are required, please use “dot notation " Below is a sample of 
dot natation; 

PfU'FlX 000000 1 PREF1NOOOOOQ3 

PREFIXItOOWO 1.00 1 PRfiFl.XOOOODD3.IK51 

PRBlTXOODOOn | .002 PREFIX 0000003.002 


ft 
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Specifications for Production of ESI nnd Digitized ("Scanned") Images 
('‘Production Specifications") 

21. Media Formats for Storage and Delivery of Production Data 

Electronic documents and data sluill be delivered on any of the following media; 

a. CD-ROMs and-'or DVD-R (•*•/-) Itamaned to IS0A6G 113*16 and Universal Disk Formal 1 .02 
specifications. 

b. External hard drives |USB 2.0 (or heller) of eSATA. formatted (o N TPS formal specifications! or flash 
drives'. 

c. Storage media used to deliver ESI shall lie appropriate lo the size of lire data in die production. 

d. Media should he labeled with the ease twine, production date, Brtief range, and producing party. 

22. Virus Protection and Security for Delivery of Production Until 

Production data shall he five of computer viruses. Aity files found to include a vims shall be quarantined by the 
producing pjtny and noted in a log to be provided (o live government. Password pwlectedor encrypted files or 
media shall In; provided with corresponding passwords und specific deception instmciium. No euciypiion 
software shall be used without the written consent of Lire government. 

22. Compliance and Adherence to Generally Accepted Technical Standards 

Production fiholl he in conformance with standuids and prewiecs established hy the National Institute of Standards 
and Technology ("NIST" at www.nku.gov), U.S. National Alt hives & Records Administration (“NAKA” in 
www.rti cldves.iun ). American Records Management Association (“ARM A Intemnllcmar’ttl www.nrmn.org). 
American National Standards Institute ('‘ANSI" at www.aosi.org), International Organization for Standard! /at ion 
(“ISO" m www.iso.QVg). and/or other U.S. Government ot professional organizations. 

24. Rend Me Text File 

All deliverables shall include a rend me text tile at the root directory* containing: total number ol records, total 
number of iinnges/|vages or lllbs, inapplwgpf fields lo plainly Identify field names, types, lengths and formats, 
flic file shall also rndicoK 11k field name to which images ivlll be linked for viewing, date and time format, und 
confirmation thal die number of files in load files matches die number of files produced. 

25. Exception Log 

An Exception Lug Shall be included documenting any production anomalies utilizing the electronic Buies number 
(document id ur control numbering) assigned during Ibe collection, processing «ikI production phntes. 


-XXX 
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Department of the Treasury 
Financial Crimes Enforcement Network 

Advisory 

FIN-20 1 2-A0IO 
Issued: October 22, 2012 

Subject: Risk Associated with Third-Party Payment Processors 



The Financial Crimes Enforcement Network (PtaCEN) is issuing this Advisory to provide 
guidance to financial institutions when filing Suspicious Activity Reports (SARs) on activities 
related to third-party payment processors ("Payment Processors”). This Advisory furthers the 
Department of the Treasury’s broader efforts to protect the ll.S financial system from money 
laundering and terrorist financing. 

Description or Third-Party Payment Processors 

Non-Bank, or third-party, Payment Processors are financial institution customers that provide 
payment processing services to merchants and other business entities, typically initialing 
transactions on behalf of merchant clients that do not have a direct relationship with the Payment 
Processor’s financial institution. Payment Processors use their own deposit accounts at a 
financial institution to process such transactions and sometimes establish deposit accounts at the 
financial institution in the names of their merchant clients. Traditionally, Payment Processors 
contracted primarily with U.S. retailers that had physical locations in the United States in order 
to help collect monies owed by customers on the retailers’ transactions. These merchant 
transactions primarily included credit card payments, but also covered Automated Clearing 
House (ACH) debits and creating and depositing remotely created checks (RCCs) or “demand 
drafts," Widi the expansion of the Internet, Payment Processors may now service a variety of 
domestic and international merchants, including conventional retail and Internet-based 
establishments, prepaid travel, and Internet gaining enterprises. 1 


' See Federal Financial Institutions Examination Council (FFIEC) Exam Manual, pp 219-242 (April 29, 2010), 
Although the FFIEC Exam Manual is issued by lire federal banking regulators and relates io AML requirements 
applicable (o banka, it contains guidance that may be of interest lo alt financial institutions drat provide fmunciul 
services to Payment Processors and MSBs. 
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Potential Red Flags for Illicit Use pf Payment Processors 1 * 3 

1-aw enforcement has reported to FinCEN that recent increases in certain criminal activity have 
demonstrated that Payment Processors present u risk to the payment system by making it 
vulnerable to money laundering, identity Ihcll, fraud schemes, and illicit transactions Many 
Payment Processors provide legitimate payment transactions for reputable merchant clients. The 
risk profile of such entities, however, can vary significantly depending on the composition of 
their customer base. For example. Payment Processors providing consumer transactions on 
behalf of telemarketing and Internet merchants may present a higher risk profile to o financial 
institution than would other businesses. Telemarketing and Internet sales and UC’C-related 
transactions tend to have relatively higher incidences of consumer fraud or potentially illegol 
activities, 

Trends and indicators of suspicious activity associated with Payment Processors arc provided by 
federal, state, and local law enforcement agencies, who work together under the Financial Fraud 
Enforcement Task Force s (FFETF) Consumer Protection Working Group. Suspicious activity 
as described below often is associated with Payment Processors engaged in improper or illegal 
conduct. 

• brand: High numbers of consumer complaints about Payment Processors and/or merchant 
clients, and particularly high numbers of returns or charge backs (aggregate or otherwise), 
suggest that the originating merchant may be engaged in unfair or deceptive practices or 
fraud, including using consumers’ account information to create unauthorized KCCs or ACH 
debits: Consumer complaints arc often lodged with financial institutions. Payment 
Processors, merchant clients, consumer advocacy groups, online complaint Web sites or 
blogs, and governmental entities such as the Federal Trude Commission and state Attorneys 
General. 

• Accounts at Multiple Financial Institutions: Payment Processors engaged in suspicious 
activity often maintain accounts at more than one financial institution. Similarly, they may 
move from one financial institution to another within a short period. Such Payment 
Processors also may use multiple financial institutions und maintain redundant banking 
relationships in recognition of the risk to the Payment Processor and merchant that a financial 
institution may recognize the suspicious activity and terminate the Payment Processor and/or 
merchant accounts. In addition, regulators and law enforcement have recognized an 
increased use of“chcck consolidation accounts”' by some Payment Processors. 


1 For additional information on fraudulent schemes identified by various government offices, refirr to their websites 

Bad the POJ FFTHT site www. STOf'F RAtfD.GO V Additional infoiimtion on consumer fraud in wiving the use of 
Payment Processors and RCClt can be found at http 7/www.ftc.ff Ov/. 

5 Relumed Check Consolidation Accounts are legitimate and commonly used by commercial enterprises to facilitate 
processing of returned checks. Recently, however, some Payment Processor: have used these accounts to establish 
separate deposit accounts to disposition their returned check items for the purpose of making it difficult for financial 
institutions to identify and evaluate “retum/error* rates for the Payment Processor. In some instances, both the 
deposit account and the returned check consolidation account are held at the same institution but in different 
accounts In other instances, the accounts arc held at separate Institutions, hi either ease, this account relationship 
structure severely inhibits a financial institution's ability to monitor and report suspicious activity 
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Consolidation accounts can be used by Payment Processors to conceal high return or 
chargeback rates from originating financial institutions and regulators, 

• Money Laundering: Criminals are continually looking for ways to launder illicit proceeds, 
including the proceeds of consumer fraud. Payment Processors ciui be used by criminals to 
mask illegal or suspicious transactions and to launder proceeds of crime. In addition, 
Payment Processors have been used to place illegal funds directly into u financial institution 
using AC) I credit transactions' originating from foreign sources. 

• Enhanced Risk: There arc potential risks associated with relationships with third-party 
entities, in particular foreign -located payment processors that process payments for 
telemarketers, online businesses, and other merchants. These relationships can pose 
increased risk to institutions and may require careful due diligence und monitoring. 

• Solicitation for Business: Payment Processors engaged in suspicious activity have been 
known to solicit business relationships with distressed financial institutions in need of 
revenue and capital. Such Payment Processors may consider troubled financial institutions to 
be more willing to engage in higher -risk transactions. In some eases. Payment Processors 
also have committed to purchasing stock in these financial institutions to further induce the 
financial institution to provide hanking services to high risk merchants. Often, the targeted 
financial institutions arc smaller community banks that lack the infrastructure to properly 
manage or control a high-risk Payment Processor relationship. Fraudulent merchants also 
have been known to possess accounts through payment processors nl large financial 
institutions. 

• Elevated rate of return of debit transactions due to unauthorized transactions: Payment 
processors engaged in or eomplicit in suspicious activities may rctlect u rate of return of 
debit items due to unauthorized transactions substantially higher than the average. Payment 
processors abused by criminals may show an acceptable rate (be. an average within normal 
parameters for the payment system involved) of returned items due to unauthorized 
transactions, calculated as a percentage of the processor's total transaction volume, but a 
much higher rate of returned items when the ratio is calculated on the traffic volume of 
individual originators. 


Guidance 

Financial institutions providing services to Payment Processors institutions may find it necessary 
to update their anti-money laundering programs . 4 Financial institutions should determine during 
thorough initial and ongoing due diligence, to the extent possible, whether external investigations 
or legal actions arc pending against a Payment Processor or its owners and operators. Financial 


* See footnote 1 above. 
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institutions also should determine whether Payment Processors have obtained ail necessary state 
licenses, registrations, and approvals. 5 

Additionally, financial institutions may be required to file SAKs if they know, suspect, or have 
reason to suspect that a Payment Processor htis conducted a transaction involving funds derived 
from illegal activity, including, but not limited to, consumer fraud. A financial institution also 
may be required to file a SAR where it knows, suspects, or has reason to suspect that a Payment 
Processor has attempted to disguise funds derived from illegal activity, or has attempted to 
engage in transactions designed to evade regulations promulgated under the Hank Secrecy Act 
(“BSA") or that lack a legitimate business or apparent lawful purpose. 1 ' 

To assist law enforcement in investigating and prosecuting possible criminal activity involving 
Payment Processors, FcnCEN requests that, when reporting suspicious activity, financial 
institutions (1) check the appropriate box on the SAR form to indicate the type of suspicious 
activity, and (2) include the term “Payment Processor” in both the narrative portion and the 
subject occupation portions of the SAR. 

Questions or comments regarding the contents of this Advisoiy should be addressed to the 
FinCHN Regulatory Helpline at 800-949-2732. Financial institutions wanting to report 
suspicious transactions that may relate to terrorist activity should call the Financial Institutions 
Toll-Free Hotline at (866) 556-3974 (7 days a week, 24 hours a day). 


J financial Crimes linforcement Network. “Advisory - Intei-agency Interpretive Guidance on Providing Banking 
Services (o Money Services Businesses Operating in the United Stales,'' (April 26, 2005), aynilaNe m 

^ Sec. e.g. 31 CFR§ 1020.320. 
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rUit* Financial Institution Letter 

■ FIL-3-2012 

Federal Deposit Insurance Corporation January 31 201 2 

560 17m Slreel NW. WarfUnptofl. O.C. IM23-9990 7 r 

Payment Processor Relationships 

Revised Gui d ance 

Summary: Attached is revised guidance describing potential risks associated with relationships with third-party 
entities that process payments for telemarketers, online businesses, and other merchants (collectively 
"merchants' 1 ). These relationships can pose increased risk to institutions and require careful due diligence and 
momlonng, This guidance outlines certain risk mitigation principles for this type of activity. 

Statement of Applicability to Institutions with Total Assets under $1 Billion: This guidance applies to all 
FDIC-supervIsed financial institutions that have relationships with third-party payment processors 


Highlights: 

• Account relationships with third-party entities that 
process payments for merchants require careful 
due diligence, close monitoring, and prudent 
underwriting 

• Account relationships with high-risk entitles pose 
increased risks, including potentially unfair or 
deceptive acts or practices under Section 6 of the 
Federal Trade Commission Act. 

• Certain types of payment processors may pose 
heightened money laundering and fraud risks If 
merchant client identities are not verified and 
business practices are not reviewed. 

• Financial institutions should assess risk tolerance 
in their overall risk assessment program and 
develop policies and procedures addressing due 
diligence, underwriting, and ongoing monitoring of 
high-risk payment processor relationships. 

• Financial institutions should be alert to consumer 
complaints or unusual return rates that suggest the 
inappropriate use of personal account information 
and possible deception or unfair treatment of 
consumers, 

• Financial Institutions should act promptly when 
fraudulent or Improper activities occur relating to a 
payment processor, including possibly terminating 
the relationship. 

• Improperly managing ihBse nsks may result in the 
imposition of enforcement actions, such as civil 
money penallies or restitution orders. 


Distribution: 

F DIC-Supwrviaod Institutions 

Suggested Routing: 

Chtef Executive Officer 
Executive Officers 
Compliance Officer 
Chief Intormutiou Officer 
BSA Officer 

Related Topics: 

Guidance or) Payment Processor Retatlonsl'lpu (FIL 127-2008, 

November 2008) 

Consumer Protection, Compliance Risk, and Risk Management 
rcfiO Guidance tor Managing Third-Party Risk (Fll 44-2006, Juno 
2005) 

FFIEC Handbook on Retail Payment Systems (Fobruory 2010) 
FFIEC Handbook on Outsourcing technology Sb«vIc«?s (June 2004) 
FF|FC Dan* Secrecy AcS/Anli-Munvy Laundering (BSAJAMt.) 
txonJnntfon Manual (April 2010) 

Managing Risks in Third-Parly PaymeN Processor Relationships 
(Somme* 201 1 Supervisory Insights Journal) 

Attachment: 

Revhod Guidance on Payment Processor Rolalionstilfw 

Contacts: 

Kathryn Wealheiby. f xiirniualion Spoclalisl (Fraud), Division ot Risk 
Management Supervision, at tnyflalheibVfiiWic.qov or (703) 254- 
0460 

John Bowman, Review Examiner, Division ot Depositor and 
Consumer Protection, at lbowrru itrftH(lic.Qqy or (202) BUB-06/4 


Note: 

KniC Financial institution letters may be accessed from tho FDtC's 

To renetvw Financial InrUllution Letters electronically, please visit 
htln^nvnv Idle aov/aboul/s iibscfip Hon^ii hum Papci copies may 
be obtained through the FDlCs Public Information Center. 3501 
Fairfax Ortw. L-1002. Arlfhflion, VA 22226 (877-276-3342 or 703 
502-2 200). 
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Financial Institution Letter 
HL-3-2012 
Junuary 31, 2012 


Revised Guidance on Payment Processor Relationships 

The FDIC has recently seen an increase in the number of relationships between financial 
institutions and payment processors in which the payment processor, who is a deposit customer 
of the financial institution, uses its relationship to process payments for third-party merchant 
clients. Payment processors typically process payments either by creating and depositing 
remotely created checks (RCCs) — often referred to as “Demand Drafts" — or by originating 
Automated Clearing House (ACH) debits on behalf of their merchant customers. The payment 
processor may use its own deposit account to process such transactions, or it may establish 
deposit accounts for its merchant clients. 

While payment processors generally effect legitimate payment transactions tor reputable 
merchants, the risk profile of such entities can vary significantly depending on the make-up of 
their customer base. For example, payment processors that deal widi telemarketing and online 
merchants 1 may have a higher risk profile because such entities have tended to display a higher 
incidence of consumer fraud or potentially illegal activities than some other businesses. Given 
this variability of risk, payment processors must have effective processes for verifying their 
merchant clients’ identities and reviewing their business practices. Payment processors that do 
not have such processes can pose elevated money laundering and fraud risk for financial 
institutions, as well as legal, reputational, and compliance risks if consumers arc harmed. 

Financial institutions should understand, verify, and monitor the activities and the entities related 
to the account relationship. Although all of the core elements of managing third-party risk should 
he considered in payment processor relationships (e.g., risk assessment, due diligence, and 
oversight), managing this risk poses an increased challenge for (lie financial institution when 
there may not be a direct customer relationship with the merchant. For example, il may be 
difficult to obtain necessary information from the payment processor, particularly if a merchant 
is also a payment processor, resulting in a “nested” payment processor or “aggregator” 
relationship. 

Financial institutions should ensure that their contractual agreements with payment processors 
provide them with access to necessary information in a timely manner. These agreements should 
also protect financial institutions by providing for immediate account closure, contract 
termination, or simitar action, as well as establishing adequate reserve requirements to cover 
anticipated charge backs. Accordingly, financial institutions should perform due diligence and 
account monitoring appropriate to the. risk posed by the payment processor and its merchant 


‘ Examples of (demarketing, online businesses, and other merchants that may have a higher incidence of consumer 
fraud or potentially illegul activities or lYMty otherwise pose elevated risk include credit repair services, debt 
consolidation and forgiveness programs, online gambling-related operations, government grant or will-writing kits, 
payday or subprime loans, pornography, online tobacco or firearms Sales, pharmaceutical sales, sweepstakes, and 
magazine subscriptions. This list is not all-inclusive. 


I 
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base. Risks associated with this type of activity are further increased if neither the payment 
processor nor the financial institution performs adequate due diligence on the merchants For 
which payments are originated. Financial institutions arc reminded that they cannot rely solely 
on due diligence performed by the payment processor. The FDIC expects a financial institution 
to adequately oversee all transactions and activities that it processes and to appropriately manage 
and mitigate operational risks. Bank Secrecy Act (BSA) compliance, fraud risks, and consumer 
protection risks, among others 

Potential Risks Arisiug from Payment Processor Relationships 

!>cposi! relationships with payment processors expose financial institutions to risks not 
customarily present in relationships with other commercial customers. These include increased 
operational, strategic, credit, compliance, and transaction risks. In addition, financial institutions 
should consider the potential for legal, reputational, and other risks, including risks associated 
with a high or increasing number of customer complaints and returned items, and the potential 
for claims of unfair or deceptive practices. Financial institutions that fail to adequately manage 
these relationships may be viewed as facilitating a payment processor ‘s or merchant client ‘s 
fraudulent or unlawful activity ami, thus, may be liable for such acts nr practices. In such cases, 
the financial institution and responsible individuals have been subject to a variety of enforcement 
and other actions, Financial institutions must recognize and understand the businesses and 
customers with which they have relationships and the liability risk tor Facilitating or aiding and 
abetting consumer unfairness or deception under Section 5 of the Federal Trade Commission 
Act. 1 2 

Financial institutions should be alert for payment processors (hat use more than one financial 
institution to process merchant client payments or that have a history oT moving from one 
financial institution to another within a short period. Processors may use multiple financial 
institutions because they recognize that one or more of the relationships may be terminated as a 
result or suspicious activity. 

Financial institutions should aBo be on alert for payment processors that solicit business 
relationships with troubled financial institutions in need of capital. In such cases, payment 
processors will identify and establish relationships with troubled financial institutions because 
these financial institutions may be more willing to engage in higher-risk transactions in exchange 
for increased fee income. In some cases, payment processors have also committed to purchasing 
stock in certain troubled financial institutions or have guaranteed to place a large deposit with the 
financial institution, thereby providing additional, much-needed capital. Often, the targeted 
financial institutions are smaller, community banks that lack the infrastructure to properly 
manage or control a third-party payment processor relationship. 


1 Under Section 8 of the Federal Deposit Insurance Act, lire FDIC has authority to enforce the prohibitions against 
Unfair or Deceptive Acts or Practices (UDAP) in the Federal t rade Commission Act. UDAP violations can result in 

unsatisfactory Community Reinvestment Act ratings, compliance rating downgrades, restitution to consumers, and 
the pursuit of civil money penalties. 
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Financial institutions also should be alert to an increase in consumer complaints about payment 
processors and/or merchant clients or an increase in the amount of returns or charge backs, all of 
which may suggest dial the originating merchant may be engaged in unfair or deceptive practices 
or may be inappropriately obtaining or using consumers’ personal account information to create 
unauthorized RCCs or AC1 1 debits. Consumer complaints may be made to a variety of sources 
and not just directly to the financial institution. They may be sent to the payment processor or the 
underlying merchant, or directed to consumer advocacy groups or online complaint Web sites or 
blogs. Financial institutions should take reasonable steps to ensure they understand the type and 
level of complaints related to transactions that it processes. Financial institutions should also 
determine, to the extent possible, if there are any external investigations of or legal actions 
against a processor or its owners and operators during initial and ongoing due diligence of 
payment processors. 

Financial institutions should act promptly to minimize possible consumer harm, particularly in 
coses involving potentially fraudulent or improper activities relating to activities of a payment 
processor or its merchant clients. Appropriate actions include filing a Suspicious Activity 
Report/ requiring the payment processor to cease processing for a specific merchant, freezing 
certain deposit account balances to cover anticipated charge backs, and/or terminating the 
financial institution’s relationship with die payment processor. 

Risk Mitigation 

Financial institutions should delineate clear lines of responsibility for controlling risks associated 
with payment processor relationships. Controls may include enhanced due diligence; effective 
underwriting; and increased scrutiny and monitoring of high-risk accounts for an increase in 
unauthorized returns, charge backs, s-nspicious activity, and/or consumer complaints. 
Implementing appropriate controls for payment processors and their merchant clients can help 
identify payment processors that process items for fraudulent telemarketers, online scammers, or 
other unscrupulous merchants and help ensure that Ihc financial institution is not Facilitating 
these transactions. Appropriate oversight and monitoring of these accounts may require the 
involvement of multiple departments, including information technology, operations, BSA/anti- 
moncy laundering (AML), and compliance. 

Due Diligence ami Underwriting 

Financial institutions should implement policies and procedures designed to reduce the 
likelihood of establishing or maintaining inappropriate relationships with payment processors 
used hy unscrupulous merchants. Such policies and procedures should outline Lhe bunk’s 
thresholds for unauthorized returns, Ihc possible actions that can be taken against payment 
processors that exceed these standards, and methods for periodically reporting such activities to 
the bank’s board of directors and senior management. 


1 The U.S Department of Treasury's Regulation 31 (CFR 103.18) requires That every federally supervised banking 
organization fde a SAR when the institution delects a known or suspected violation of federal law Part 353 of the 
FDIC's Rules and Regulations addresses SAR filing requirements and makes them applicable to ail state -chartered 
financial institutions that ait not members of the federal Reserve System. 
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As part of such policies and procedures, financial institutions should develop a processor 
approval program that extends beyond credit risk management. This program should include a 
due diligence and underwriting policy that, among other things, requires a background check oT 
the payment processor, its principal owners, and its merchant clients. This will help validate the 
activities, creditworthiness, and business practices or the payment processor, as well as identify 
potential problem merchants. Payment processors may also process transactions for other 
payment processors, resulting in nested payment processors or aggregator relationships. The 
financial institution should be aware of these activities and obtain data on the nested processor 
and its merchant clients. Nested processors and aggregator relationships pose additional 
challenges as they may be extremely difficult to monitor and control; therefore, risk to the 
institution is significantly elevated In these cases. 

Controls and due diligence requirements should be robust for payment processors and their 
merchant clients. At a minimum, the policies and procedures should authenticate the processor's 
business operations and assess the entity’s risk level. An assessment should include: 

• Identifying the major lines of business and volume for the processor’s customers; 

• Reviewing the processor's policies, procedures, and processes to determine the adequacy 
of due diligence standards for new merchants; 

• Reviewing corporate documentation, including independent reporting services and, if 
applicable, documentation on principal owners; 

• Reviewing the processor's promotional materials, including its Web site, to determine the 
target clientele ; 4 

• Determining if the processor re-scllb its services lo a third party tlmt may he referred to as 
on agent or provider of “Independent Sales Organization opportunities” or a “gateway 
arrangement ” 5 and whether due diligence procedures applied to those entities arc 
sufficient; 

• Visiting the processor’s business operations center; 

• Reviewing appropriate databases to ensure that the processor and its principal owners and 
operators have not been subject to law enforcement actions; and, 

• Determining whether any conflicts of interest exist between management and insiders of 
the financial institution. 


" See footnote 1 for examples of potentially high-rbk areas. 

* An Independent Sales Organization is an outside company contracted to procure new merchant relationships 
Careway arrangements are similar to Internet service providers dint sell excess computer storage capacity to third 
parties, who in turn distribute computer services to oilier individuals unknown lo the provider. ITte third party would 
make decisions about who would he receiving the service, although the provider would be responsible fnr the 
Ultimate storage capacity 


A 
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Financial institutions should require that payment processors provide information on their 
merchant clients, such as the merchant's name, principal business activity, location, and sales 
techniques. The same information should be obtained if the merchant uses sub-merchants (oltcn 
called -affiliates"). Additionally, financial institutions should verify directly, or through the 
payment processor, that the originator of the payment (i.c., the merchant) is operating a 
legitimate business. Such verification could include comparing the identifying information with 
public record, fraud databases, and a trusted third party, such as a consumer reporting agency or 
consumer advocacy group, and/or checking references front other financial institutions. The 
financial institution should also obtain independent operational audits of the payment processor 
to assess the accuracy and reliability of the processor’s systems. The more the financial 
institution relies on the payment processor for due diligence and monitoring of its merchant 
client without direct financial institution involvement and verification, the more important it is to 
have an independent review to ensure that the processor’s controls are sufficient and that 
contractual agreements between the financial institution and the third-party payment processor 
are honored. 

Ongoing Monitoring 

Financial institutions that initiate transactions for payment processors should implement systems 
to monitor for higher rales of returns or charge backs and/or high levels of KCCs or ACH debits 
returned as unauthorized or due to insufficient funds, all of which often indicate fraudulent 
activity, This would include analyzing and monitoring the adequacy of any reserve balances or 
accounts established to continually cover charge-back activity. 

Financial institutions are required to have a BSA/AMI. compliance program and appropriate 
policies, procedures, and processes for monitoring, detecting, and reporting suspicious activity. 
However, nonbank payment processors generally are not subject to BSA/AML regulatory 
requirements, and therefore some payment processors are more vulnerable to money laundering, 
identity theft, fraud schemes, and illicit transactions. The FPIBC HSA/AM1. Examination 
Manual urges financial institutions to effectively assess and manage risk associated with third- 
party payment processors. As a result, a financial institution’s risk mitigation program should 
include procedures for monitoring payment processor Information, such as merchant data, 
transaction volume, and charge-back history. 

Consumer complaints and/or high rates of return may be an indicator of unauthorized or illegal 
activity. As such, financial institutions should establish procedures for regularly surveying the 
sources of consumer complaints that may he lodged with the payment processor, its merchant 
clients or their affiliates, or on publicly available complaint Web sites and/or blogs. This will 
help tire institutions identify processors and merchants that may pose greater risk. 

Similarly, financial institutions should have a formalized process for periodically auditing their 
third-party payment processing relationships: including reviewing merchant client lists and 
confirming that ihc processor is fulfilling contractual obligations to verify the legitimacy of Its 
merchant clients and their business practices. 
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Conclusion 

The FDIC recognizes that financial institutions provide legitimate services for payment 
processors und their merchant clients. However, to limit potential risks, financial institutions 
should implement risk mitigation policies and procedures that include oversight and controls 
appropriate for the risk and transaction types of the payment processing activities, At a 
minimum, Oourd-approved policies and programs should assess the financial institution's risk 
tolerance for litis type of activity, verify the legitimacy of the payment processor’s business 
operations, determine the character of tile payment processor's ownership, and ensure ongoing 
monitoring or payment processor relationships for suspicious activity, among other things. 
Adequate routines and controls will include sufficient staffing with the appropriate background 
and espei ience for managing third-party payment processing relationships of the size and scope 
present at the institution, as well ns strong oversight and monitoring by the board and senior 
management Financial institutions should act promptly if they believe fraudulent or improper 
activities potentially resulting in consumer harm have occurred related to activities of a payment 
processor or its merchant clients, in accordance with their duties under BSAMML policies and 
procedures, as well as under Section 5 of the Federal Trade Commission Act, which prohibits 
unfair nr deceptive acts and practices. 


Sandra L. Thompson 
Director 

Division of Kisk Management Supervision 


Mark Pearce 
Director 

Division of Depositor and Consumer Protection 
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OCC; Payment Processors: Risk Management Guidance 


Page l ot 2 


O Office of tho 

Comptroltor of tho Currency 

U.S Dopurtiiwnt <if ffiu Trousury 


OCC 2009*12 


Subject' Payment Processor* To: Chief Executive Officers, Chief Rak Officers and Compliance 

Date: April 24, 2008 Otflceru of A0 National Bank*. Federal Branches and Agencies, 

Technology Service Providers, Department arul Division Hoads, and 
All Examining Personnel 


Description: Risk Management Guidance 


Purpose 

rha buSelin presents guidance in ruwmivil banks for duo (Wtgodco, underwriting, and monitoring or entrlies mat process payments tor 
lolinnarketera and oilier merchant client*. As itolartod in several OCC Issuhtcus. ctsnuxi merchants, ouch as Mnrearidttors, pose a tughor risk 
than Olhor roomhunts and require additional due diligence end close more toeing I Ms bukusn »upptom*nia but dows not replace existing guidon co 
rotated Id AuiomcMed Owning Mouse (ACH) risk management, merchant processing, and remotely ooainci chucks (RCCs). 


Background 

The OCC hn* seen a variety of retalkonshlps between barks and processors m which the orocouor osos its bank rolatiorsbip to process 
payments tor merchant clients. Often Itvo processor uses a bank account as the vehicle to conduct such payment p,oc.ussii*g. For example, a 
processor may b« « bank customur that deposits Into its account RCCs generated on behalf of merchant clients. A processor may also oct os a 
1 bird -party sender of ACH transactions, nnflinalvig debits for its merchant dlen's through it* customer relatjonsbip wilh Itte bank in either case toe 
bank alien lies no direct customer relationship with the meichont Risks two huighlunod when neither tho processor nor the bank performs 
adequate due (UUgohCO on tou murctwiril* for which Ibny are originating poyrrvenfs. 

Whan a bank has a rahUtonstup with a processor, il Is (uposed to nsks that may not be present In relattonsNos wilh olN»r commercial customers, 
rite bank encounters strategic, credit, complronoe. transaction. and roputatlun nsks m these ra*alton«ilps. Bonks hove two cfictir.cl oroas ot 
responsibility to control »iuso nsks The Irsl is due dibgnnce and underwriting, and thn second is monitoring these high-nsk acnaunls to« high 
levels of unauthorised returns and for suspicious or unusual patterns of activity. Proper sniUal due dilrgurtcu. effective underwriting end one rang 
account rnonltnrtng are critical for bonk sofety and soundness and consumer protection Banks should implenmnl ITiese controls to reduce tho 
likelihood ot establiahmg or murotaewig an inappropriate rctattonakip wilh a processor through which unscrupulous merchants can gam access to 
corauimurs' bank accounts. 

Ranks should also consxtei carefully tho legal, regulation, and other risks presented by relationship* with processor* including nsks associated 
with Customer oomplalnH, relumed items, and potential unfair or deceptive practices. 1 Banks that do not have tou appropriate controls to address 
the nsks «n these relationships imy be viewed a* (iicliiaiing a processor's or ds march ant client's fraud <y olner unlawful activity. Banks should be 
mart lor processors Inal uao more than one bonk to pieces* paymenla tor merchant clients and ihoidd subject aueh processors to ^reat scrutiny 
Processing through multiple bonks may bo o ugoal that the processor recognzas a risk that ono or more of these process *>g rvilelmnsnips may be 
terminated a? a result of sueotcwuB, fraudulent or othur unlawful conduct/ 

Risk Management: Effective Due Diligence, Underwriting, and Monitoring 

Thn OCC hns provided guidance to notional banks regarding relationships Willi processors. For example. bonks must implement a due ciUgtrece 
end underwriting policy (hat, among other things. noqulrr*j» an iralfol background chuck of the processor and its undo* lying rnnr cherts to support tho 
validity of the processors ood morchnnls' businesses. Ihelr wraJMworOiinoss. end business preeileea * Moreover, the OCC hos aiJO pravrdod 
banks delated procodums foi morcfianr underwriting and review, ss well as for fraud monitoring 4 Bank* should review ouof-jfly the validity and 
creditworthiness of a't processors and morchanta. Controls should tie more rigorous to* higher-risk processors and merchants (e g., 
talemarKetersj. Although some processors may process transactions tor reputable telemarketing merchant thoso morcfianls in aggregate have 
displayed a much higher incidence ot unauthorized return® or chargebacks, which Is often titdloitiv* of ftaUdufenl activity 

Duo dillyunco, unriorwrtttog und account monitoring ere especially important for banks n wt»eft prcconort deposit RCCs and through wnich 
processors vilUute AC1I lianxa&icx.* tor Ifwir mor chord dkinte. Ranks should be alen tc procns&u,-*' murchani cStart* that obtain personal bark 
account infurniatio*» inappropriate^ The merchant may have misused the customer Information 1o foaiiialc Uie CMMtran id an unoutoarized RCC 
or ACH debit Me by the prooavsnr,’ To ensure effective risk inwtegomonl. banks that mutate transactions for orocessor* should loqrare Ihe 
processor to provide information on their merchant ckents such a* the merchant's Panto, pnncipal business aotlvify, and gnegraprte tocabOh.* 
Ranks should verify directly, ur Pwuugh Ihe processor, that tho originator of the payment (/.a tho merctiant) i» aperattog a leg'lmwlu business 
Such veriFication coidd inrtuda comparing the identifying mformation agamat uobfc record databases and fraud and bad chock datobruo*. 
compering the identifying intofmetion with m formation from a Irustud third party such as a credit inporl froni a cunsumer reporting aguncy. or 
checking retoiunoos from Obxjr linendel Insbtulion* vMlh resperj to account monitaraig t bunk should not accept high tauoH of leturns' on tho 
hrons that Ihe processor hn* piovidod cottaioral or other security to the twnk 

By implemenHng too approprtete controls over pioutssor* and their merchant diants. a benk *hoiid be nhlo to •hnnlTv those processors that 
process for fraud ufor* kdomerkolor* or other unscropulou* merchants and to onsuro thal too bur* is not fadlltallng Ihrran transactions. In bw 
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OCC: Payment Processors: Risk Management Guidance 


Page 2 of 2 


ovont a bank idontlflds fraudulent « olhor improper activity with a prucessw oi a apecittc merchant client ct the omcusior, the bank should Mkn 
immediate steps lo addross tho problem. meowing tiling a Suspicious Activity Repel when appropriate, terminating the bank * mlahormivp vs*lh the 
processor, or requiring the processor to cease processing for that specific merchant 

Banks ans raquirod lo have Bank Secrecy Act/An ti-Monoy Laundenng (BSA/AML) compOanco programs and opproprroto policies, procedures. Odd 
processes to monitor and identity unusual activity, AddllionoHy, tho FFIEC BSA/AML Examination Manual reiterates the OCC** expecrabun that 
banks effectively assess and manage their risks with respect to third-party processors. Processors generally are no! tubyact to BSAMML 
regulatory TfMtueemonis. As a result, some processors may bo vulnerable lo monuy laundering. identity !h«H, Irnud schemes, and isiot 
transactions or transactions prohibited by lha Office of Foreign Assets Control. The bank s nek management program stvsjld Indudo proouduros 
(or monitoring proouesot information such as morduwd data, transaction vnfoma, urvd chwgo-buek history. 1 ' 


Conclusion 

The OCC supports naftonat banks participation In paymont systems lo sorvo Ihc noods of logltunato processors and the customers Ol swell 
processor* and lo diversity sources o( mvonuo. However lo limit potential risk to banks and consumers, banks should ensure implementation of 
n*k management programs that include appropriate overnight and controls commensurate with the risk and compfovtiy of the aetivilkHL At * 
minimum, bank program* should verity Iho legitimacy of tho processor's business operations, assrm the bank's risk level, and monitor processor 
relallon ships for activity mdicatNe of fraud 


Additional Information 

For additional information rotated lo managing the risks associated with retaJ payment activities pteasa refer la; 

• OCC Bulletin 2006-39, ACH Actrvibes Risk Monngemen! Guidance 

• The "Merchant Processing" booklet of the Compftotioris Handbook. 

• OCC Bulletin 2006-13, Amendments lo Regulation CC and J, 

• OCC Bulletin 200 1-47, Third-Party Relationships: Risk Managemanl PmoDfas 

• Thu “Outsourcing Technology Suryicos' booWol of the Federal Financial Institutions examination Council f/VVEC) fotormuffon Technology 
(IT) Examination Handbook 

• Thn "Retail Payment Systems" bookM of the FFIFC IT Fxwnftation Handbook. 

• Thu FFIEC Bank Secrecy Act/Anti-Monoy Laundering tBSA/AMU Examination Manual 

Ptoaso direct any questions or cornmenls to ihc Oporational Risk Holley Dhrtsron at <202) 874-5190 
Mark l O'Dell 

Deputy Comptroller for Operational Risk 
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Mr. Issa. Thank you. 

In this document, which I am 

Mr. Bachus. Now we will start your time. 

Mr. Issa. Thank you. Thank you. That would be great. 

Mr. Bachus. Or are you still introducing your 

Mr. Issa. I am done introducing. 

Mr. Bachus. Okay. 

Mr. Issa. But in this document it, which I am told there is at 
least 50 subpoenas identical to this other than the name, are you 
familiar with this document? 

Mr. Delery. I believe so. I certainly am familiar with ones like 
that. I am not sure about that one. 

Mr. Issa. We know that 50 subpoenas were served that were sub- 
stantially similar or identical except for name. How many sub- 
poenas did you serve similar to the one that you believe I have got 
here? 

Mr. Delery. Well, again, I do think some of the documents have 
indicated in the neighborhood of 50, which again, were not all nec- 
essarily identical. 

Mr. Issa. Well, let’s go through them. You named one company 
in which you had, prior to the serving of the subpoena, allegations 
of wrongdoing and complaints by customers. Is that correct? I 
mean, that is a standard to go looking, is that you have allegations 
of a bank doing things wrong, and that would be a reasonable rea- 
son. 

Mr. Delery. Yes. 

Mr. Issa. You had that in the case of Four Oaks, right? 

Mr. Delery. Again, that certainly was the basis for the case. 
And as to all of the subpoenas 

Mr. Issa. Well, you are not allowed to go on fishing expeditions 
just generally and harass banks, are you? 

Mr. Delery. In each of the 

Mr. Issa. No, no, no, that is a question. You are not allowed to 
go and just harass for the sake of — you can’t send subpoenas to 
every single bank. Let me rephrase that. The statute allows to you 
do it, but that is not your practice. Is that correct? 

Mr. Delery. That is correct. And in this case there was a reason- 
able suspicion, a reasonable basis for each of the subpoenas that 
were issued. 

Mr. Issa. Then since these cases have come to a close without 
prosecution, would you provide to us the reasonable suspicion in 
the case of the — or at least an outline of them — in the case of these 
50 subpoenas served? 

Mr. Delery. I think, Congressman, many of them relate to ongo- 
ing investigations. 

Mr. Issa. Obviously, only the closed cases. 

Mr. Delery. And so we can certainly look at the request. As I 
indicated earlier, we have a number of open 

Mr. Issa. Okay. Well, let’s go through this. It has earlier been 
testified that in fact these were just subpoenas and they were not 
intended to intimidate or cause people to change their behavior. Is 
that right? 

Mr. Delery. Right, they were intended to get information from 
institutions that we believed had evidence of fraud. 
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Mr. Issa. So now listed in those evidence of fraud, in addition to 
Ponzi schemes, which are criminal, period, and if somebody knew 
about a Ponzi scheme, it is inherently a crime, right? 

Mr. Delery. That is my understanding, yes. 

Mr. Issa. There is credit card repair services, debt consolidation, 
online gaming, government grants, or will-writing kits, payday and 
subprime. Threw in pornography, I thought that was good, that 
pornography is inherently something that you should tell people 
about. Online tobacco, is that unlawful? 

Mr. Delery. I am not sure what document you are looking at. 

Mr. Issa. I am looking at the examples that are in your sub- 
poena. Your subpoena includes an attachment of a financial insti- 
tution letter. Your subpoena, all 50 of your subpoenas included an 
intimidating list of firearm sales, pharmaceutical sales, sweep- 
stakes, magazine subscriptions, online tobacco. You included FDIC 
high-risk list in there that includes a series of lawful businesses. 
Are you aware of that? 

Mr. Delery. So the guidance was attached 

Mr. Issa. Sir, were you aware of that? 

Mr. Delery. I am aware that the guidance was attached to, my 
understanding, is not all of the subpoenas. 

Mr. Issa. Oh, okay. Well, we would love to have all of them. 

In testimony before the House Financial Services Committee on 
Tuesday you repeatedly disclaimed any involvement in the FDIC 
high-risk merchant guidance. Now, isn’t is true that — assuming 
that this is a correct document, we would like you to authenticate 
it here today, and we will provide it to you — this in fact shows that 
what you said in Financial Services just isn’t so? You included the 
guidance. You said in Financial Services you didn’t, and I quote, 
you repeatedly disclaimed any involvement with the FDIC high- 
risk merchant guidance, and then you include it in your subpoena. 

How is somebody supposed to think that you didn’t participate 
in promoting this and you put it into a subpoena that threatens the 
hell out of a small community bank or credit union? How do you 
reconcile that? 

Mr. Delery. So I would be happy to answer that question, Con- 
gressman. 

Mr. Issa. I would be happy to get an answer to that one. 

Mr. Delery. The guidance that was attached is guidance that 
the FDIC provided. It discusses in general terms the risks that 
third-party payment processors can present 

Mr. Issa. That is fine. But didn’t by inclusion of that guidance, 
didn’t you in fact by inclusion associate yourself with the position 
of the FDIC? And didn’t you on Tuesday say just the opposite in 
the Financial Services Committee? So are you going to correct the 
record at Financial Services to disclose that in fact you had associ- 
ated yourself, you had included the guidance, and you did in fact 
essentially team yourself with the FDIC for guidance that would 
say, credit card repair, payday subprime, online tobacco sales, fire- 
arm sales, ammunition sales, pharmaceutical sales, these are high 
risk, in a document you attached and then said that you are not 
associating yourself with the FDIC? Which is true? 

Mr. Delery. Congressman, I don’t think that that is a complete 
description of what I said on Tuesday. Our policy in this area 
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Mr. Issa. Did you sign the subpoenas? 

Mr. Delery. Yes. 

Mr. Issa. I find your signature on the subpoena. 

Mr. Delery. Yes. 

Mr. Issa. You signed the subpoena. It had 

Mr. Johnson. Mr. Chairman? 

Mr. Issa. I just want to make one point and I will close. 

Mr. Johnson. I just don’t want you to badger the witness. 

Mr. Issa. I don’t want to badger, I just want to make a point in 
closing, because I believe the Financial Services Committee has a 
real reason to relook at this gentleman’s testimony. He signed the 
subpoenas, he attached the subpoenas, specific allegations of high 
risk, and then before the Financial Services Committee he testified 
that in fact he was not associated, and yet it was stapled to it. 

It is not common for subpoenas to have other documents and fli- 
ers stapled to them. Generally, a subpoena isn’t owned by the 
issuing party. 

So I appreciate the gentleman yielding me the additional time. 
I thank the Chairman for his indulgence. And I will have a copy 
of this brought to the gentleman to refresh his memory of what he 
signed. 

Mr. Bachus. Thank you. 

Mr. Johnson. Well, I think it is only fair that he see the docu- 
ment that you are seeking to 

Mr. Issa. And we are going to give a copy to him right now. But 
he signed it. I figure he saw it once. 

Mr. Bachus. He signed it. 

Mr. Johnson. He still deserves to see it. 

Mr. Bachus. Well, but he signed it. I mean, he signed it. 

Mr. Johnson. You mischaracterized what he signed, if he signed 
it, and you are drawing conclusions from it that are probably 

Mr. Issa. Mr. Chairman, the gentleman may be right. I would 
like unanimous consent for the Attorney General to have the oppor- 
tunity to see it. 

Mr. Bachus. Let me ask, is that it right there? 

Do you want to see it? 

I guess we could ask him if in fact is familiar with that. 

Mr. Johnson. Because he has not been able to explain one an- 
swer in response to the questions. 

Mr. Bachus. Do you have a motion? I mean, we will give our wit- 
ness the opportunity. 

Are you familiar with that document? 

Mr. Delery. Yes, Mr. Chairman. I think it is one of the sub- 
poenas, as I indicated. 

Mr. Bachus. Well, just by way of giving you an opportunity to 
explain, did you sign that subpoena? 

Mr. Delery. Yes. 

Mr. Bachus. Okay. And is that list of high-risk categories, is 
that attached to the subpoena? 

Mr. Delery. There is a footnote in one of the attachments to the 
subpoena that makes reference to certain industries or businesses 
that the FDIC may consider to be high risk. And I think that goes 
to the point of the discussion on Tuesday. I think if you look at the 
overall discussion on Tuesday, what I explained was that our basis 
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for issuing the subpoenas was to pursue specific evidence of unlaw- 
ful conduct, based on fraud against consumers, that we were not 
seeking to target any industry or business acting lawfully. 

And in fact I also said that the participation of a financial insti- 
tution with any particular industry, whether on a high-risk list or 
otherwise, was not a basis for an action that we were pursuing. So 
I think that is what I was saying the other day, on Tuesday. 

Mr. Bachus. Actually, if you look on page 1 of that attachment, 
it not only refers to it, it lists different payday loans, tobacco sales, 
firearm sales, pharmaceutical sales, magazine subscriptions, 
sweepstakes. It actually narrows it to those categories. So it actu- 
ally is a more concise list than the FDIC’s list. 

Mr. Delery. I am not sure, Mr. Chairman, which page you are 
looking at on this point. 

Mr. Bachus. The revised guidance on payment processor rela- 
tionships, dated January 31st, 2012. 

Mr. Delery. Yeah. I think I am looking at that. That is part of 
the FDIC 

Mr. Bachus. It does say payday or subprime loans, pornography. 
You are not equating the two, are you? 

Mr. Delery. No. 

Mr. Bachus. Online tobacco or firearm sales, pharmaceutical 
sales. 

Mr. Delery. No, Congressman. No, Mr. Chairman. I think what 
we have said is that participating in any particular line of business 
is not evidence of fraud. That is not how we are 

Mr. Bachus. Do you think it was appropriate to attach a list to 
your subpoena? 

Mr. Delery. I think that, as I understand it, the purpose of the 
attachment was to respond to questions about the issues and the 
potential for fraud that third-party payment party processors pro- 
vide. 

I will come back. 

Mr. Johnson. We will have a second round. 

Mr. Bachus. Yeah, absolutely. And we will give everybody plenty 
of time. But firearm sales, I mean, that is 

Mr. Issa. Mr. Chairman, one might say beauty is in the eye of 
the beholder. And this Administration considers firearm sales, am- 
munition, as somewhat less beautiful than others. But that is the 
reason that this whole high-risk list under Operation Choke Point 
is so problematic, it makes ideological decisions of what is high 
risk, rather than economic. 

Mr. Johnson. I would like to ask this witness whether or not it 
is true that this list that we are talking about of potentially illicit 
activities that banking institutions should be aware of 

Mr. Bachus. Yeah, yeah, that is right. Illicit activities, that is a 
good word. Payday lending is illicit. 

Mr. Johnson [continuing]. Whether or not that list is something 
that predates the Obama administration. Isn’t it a fact that the 
FDIC list of activities that is the subject of this discussion is a 
product of a prior Administration? 

Mr. Bachus. I can answer that. It was 2011, which was 3 years 
into the Obama administration. 
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Mr. Issa. Mr. Chairman, for the record, in 2008 there was a 
warning on high risk, but there was no specificity. They didn’t 
name any entity. So it is very different to say beware of high risk. 

Mr. Bachus. And they didn’t subpoena. 

Mr. Issa. They didn’t subpoena. And if you a 50 percent return 
rate, that is high risk. 

Mr. Bachus. Let me say this, we are going to have a second 
round. So we will go to Mr. Jeffries. 

Mr. Johnson. Well, for the record, the OCC on September the 
1st of 2006 stated specifically listed industries associated with high 
volumes of unauthorized returns in a guidance document. 

Mr. Bachus. The Justice Department? 

Mr. Johnson. The OCC. And so these are not Justice Depart- 
ment guidelines, even though they were referred to in the sub- 
poena. 

Mr. Bachus. But what we are talking about here is a subpoena 
that cost hundreds of thousands of dollars to comply with on occa- 
sions. And you are all familiar with the term, in fact anyone that 
has ever served on Financial Services knows the term de-risking. 
That is a term that is used by the Justice Department. De-risking 
names that companies like to avoid risk. If you send them a sub- 
poena and you list companies that are “risky” firearm sales 

Mr. Johnson. Not companies, but industries. 

Mr. Bachus. Industries. They are going to avoid risk by jetti- 
soning those customers. We all know that. You know that. 

Mr. Johnson. If there is any indicia of illegal activity that would 
derive from their actions. 

Mr. Bachus. Well, getting a subpoena and saying you are inves- 
tigating fraud is a pretty, pretty strong method. 

Mr. Johnson. If you have a reasonable suspicion that a fraud 
has been committed, Mr. Chairman, I think that that is what 
our 

Mr. Bachus. And one thing, Mr. Delery, one reason that we are 
so concerned about this, normally you go to a court and you get a 
subpoena, a court approves it. This is one of the few cases under 
FIRREA, as you know, where you don’t have to get the court’s ap- 
proval. You can launch these things and the burden of proof is very 
low. 

Mr. Issa. Mr. Chairman, you are exactly right, and I think Mr. 
Johnson made the point very well, in that if there is evidence of 
fraud, which apparently there may have been in one case, then the 
subpoena would follow, if you will, almost the ordinary course, even 
though it doesn’t need a judge. 

In the case of issuing 50, if there is not a specific allegation but 
rather a laundry list of industries that they should, if you will, de- 
risk themselves from, the chilling effect on those industries is un- 
deniable. 

Mr. Bachus. Thank you. 

Mr. Jeffries, we are going to recognize you for 5 minutes now. 

Mr. Jeffries. Mr. Chairman, I appreciate the 

Mr. Bachus. Five or 6 minutes, as everybody else has had. 

Mr. Issa. I ask unanimous consent the gentleman have 7 or 8 
minutes. 
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Mr. Jeffries. After that colloquy, I was going to suggest 10 or 
15. 

And I would just suggest that I find it ironic, there is a lot of 
concern about lawlessness in this town and in this institution. I 
would just think that regular order should prevail on this Sub- 
committee, particularly a Subcommittee where we have got a topic 
so inflammatory in terms of the subject matter, guilty until proven 
innocent. 

And I guess I am struggling with that topic and reconciling its 
sort of explosive rhetoric with the notion that it seems that some 
Members have come into this Committee already presuming the 
guilt of the Justice Department and its activity connected with Op- 
eration Choke Point. 

And I guess hypocrisy is not a constraint in this institution. I 
have figured that out over my 18 months. But nonetheless, hope- 
fully we can have an exchange where I get some understanding as 
to the facts related to this program and not simply political rhetoric 
directed at the Department of Justice. 

Now, it is my understanding that three separate decisions by 
courts in the Southern District of New York have upheld the De- 
partment of Justice’s authority under FIRREA. Is that correct? 

Mr. Delery. Congressman, yes, those are referring to decisions 
that recognize the scope of the conduct that FIRREA prohibited in 
order to protect the integrity of the financial system. 

Mr. Jeffries. And would it be fair to say that some District of 
New York courts are amongst the most commercially sophisticated 
district courts in the Nation, just given the nature of the subject 
matter that they often find before them? 

Mr. Delery. Yes, I think that that is fair. And I would also point 
out that these are the only three cases that I am aware of address- 
ing the question. So all three courts to have addressed it have an- 
swered the question the same way. 

Mr. Jeffries. Right. And these courts I believe also concluded 
that the phrase affecting a Federally insured financial institution 
includes financial institution that engages in fraudulent activity 
that harms itself. Is that correct? 

Mr. Delery. Yes. 

Mr. Jeffries. Okay. And in United States v. Countrywide, I be- 
lieve the court dismissed the defendant’s argument that Congress 
did not intend FIRREA to include financial institutions that are 
parties to fraud and in fact characterized that position that seems 
to be supported by some members of this panel as utterly uncon- 
vincing. Is that correct? 

Mr. Delery. I don’t remember the phrase specifically, but I do 
think all three decisions, looking at the text, structure, and legisla- 
tive history of the statute, concluded that it provides broad anti- 
fraud protection where fraud affects a federally insured financial 
institution. 

Mr. Jeffries. Okay. And I would just note for the record that we 
are preparing to sue the President based on alleged lawlessness, 
and some within the House of Representatives have concluded that 
the Article III court system should be the arbiter as to whether this 
President has engaged in “lawlessness.” And that is fine. That is 
the prerogative of the majority in the House of Representatives. 
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But as it relates to this particular subject matter before us, as 
you have pointed out, every single court to look at the legality and 
the Justice Department’s legitimacy to move forward as it has, has 
concluded that you are well within the boundaries of the law. And 
in fact, at least in one instance, has basically characterized the ar- 
guments being made by defendants and or their sympathizers as 
baseless in law. 

And so there are a lot of things that we as a Committee and we 
as a Congress could be focused on. Certainly, I think the effort to 
hold financial institutions accountable for their actions and to 
make sure that consumers in the United States of America and 
those that we represent aren’t harmed by reckless behavior, seems 
to be an appropriate thing for the Department of Justice to be en- 
gaging in, particularly given the fact that reckless behavior by fi- 
nancial institutions writ large caused the collapse of the economy 
in 2008, plunging us into the greatest economic crisis since the 
Great Depression. 

And so I support the effort and applaud you, the Justice Depart- 
ment, for continuing to do what is necessary in the best interest 
of the American people. And I expect that as additional cases wind 
their way through the court system, they will equally be deter- 
mined to be frivolous. 

And I yield back. 

Mr. Bachus. I am sorry, you yield back? 

Mr. Jeffries. Yield back, with 5 minutes to spare. 

Mr. Bachus. Okay, thank you. That was a shock to me. I wasn’t 
expecting that. Thank you, Mr. Jeffries. 

Mr. Holding? 

Mr. Holding. Mr. Chairman, I have had my turn. 

Mr. Bachus. All right, thank you. I guess it is my turn. 

Mr. Delery, in testimony on Tuesday you repeatedly stated that 
this is normal law enforcement initiative, and we are only inter- 
ested in actual fraud. So you have issued 50 subpoenas. Is that cor- 
rect? 

Mr. Delery. That is the ballpark for the number. 

Mr. Bachus. Okay. How many settlements have you procured? 

Mr. Delery. Again, as I indicated, so far there is one case that 
has been resolved; others are ongoing. And obviously some of those 
subpoenas 

Mr. Bachus. When did you start issuing these subpoenas? 

Mr. Delery. It was in early 2013, so a little more than a year 
ago. 

Mr. Bachus. Eighteen months ago, 17 months ago, 16? 

Mr. Delery. Right. 

Mr. Bachus. And Four Oaks Bank is the only one that — so zero 
lawsuits or prosecutions, right? 

Mr. Delery. Again, there are ongoing both civil and criminal in- 
vestigations. 

Mr. Bachus. Investigations, but no prosecutions. 

Mr. Delery. Not so far. 

Mr. Bachus. Okay. So you have issued 50 subpoenas. 

Mr. Delery. And again, some of the subpoenas related to the 
same matter. 

Mr. Bachus. To the same bank? 
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Mr. Delery. Or to seeking information about the same — not nec- 
essarily to the same bank, but to related organizations or institu- 
tions that might have information 

Mr. Bachus. But 50 different financial institutions received sub- 
poenas? 

Mr. Delery. I am not sure that that is right. I think it is in the 
ballpark of 50 total. 

Mr. Bachus. The cases you cite, you talk about a 30 to 50 per- 
cent return rate or chargeback. That is pretty doggone high. I 
mean, that would alert anyone to something unusual going on. 
How did you come up with that 30 to 50 percent? 

Mr. Delery. So I referred to the merchants that are identified 
in the Four Oaks complaint. So there were more than a dozen mer- 
chants that Four Oaks knew about that had a return rate of over 
30 percent. One was 70 percent? 

Mr. Bachus. Yeah, Wachovia, First Bank of Delaware, Four 
Oaks, I mean they all had return rates of 30 to 50 percent. 

Mr. Delery. Exactly, and Wachovia and First Bank of Delaware 
I think are also good examples, and the payment processor that 
was charged in connection with Wachovia, those are the prior cases 
that are 

Mr. Bachus. Right. And you have highlighted that. I mean, 
Wachovia, First Bank of Delaware, all had these high return rates 
and chargebacks. And I am acknowledging that ought to be a red 
flag. But I notice your document request has a different return 
rate. It is 3 percent. It says that any customers’ accounts that expe- 
rience a return rate of 3 percent or greater in any 1 -month period. 
So suppose you had someone that sold ammunition, magazine sub- 
scriptions, tobacco, firearms, coin shops, and they have had one 
check returned out of 25. That would put them under this category. 

Why did you go from 30 to 50 percent to 3 percent? Three per- 
cent not over a year, but 3 percent in any 1-month period, which 
actually could be 3 checks within 1 month for somebody that did 
100 checks. They could have three returned checks in a year fall 
under that. 

Mr. Delery. The 3 percent number comes from some of the infor- 
mation requests. That is not something that we viewed as a thresh- 
old for fraud and is not the basis for a charge. 

Mr. Bachus. But in your document request it says, number 6, on 
page 6. 

Mr. Delery. Right. In some of them we asked for information 
about returns over that number which was more than twice the av- 
erage according to the industry groups. That was not intended to 
reflect 

Mr. Bachus. And some industries are going to have a higher re- 
turn rate. I mean, magazine subscriptions, there is nothing nec- 
essarily fraudulent about that. 

I guess what I am saying, you are asking financial institutions 
to go through and find out any customer they had that had 3 per- 
cent of their checks return in 1 month that did any of these “high- 
risk” businesses. 

Mr. Delery. I think that in connection with requests that we 
make, we often have a discussion about the scope and what infor- 
mation they can provide in the way that a recipient 



117 


Mr. Bachus. Well, but you asked all of them that. Then they 
have to hire lawyers. Then they have to have these discussions 
with you? And a small payday lender or ammunition seller or 
somebody selling tobacco, I mean, they have got to hire a lawyer, 
they have got to come to you, they have got to come to you and say, 
hey, can we? Do you ever modify that 3 percent? 

Mr. Delery. My understanding is that there were discussions 
with some of the recipients about the scope and, again, what infor- 
mation they had that could be provided and what would be appro- 
priate. So, again, that is a standard approach in 

Mr. Bachus. But in fact in 4 it says, documents sufficient to 
identify payment processors or merchants or clients that experi- 
enced a return rate of 3 percent or greater in any 1-month period. 
Don’t you think that is pretty low? That is a pretty wide net. I 
mean, that is a pretty wide net, isn’t it? 

Mr. Delery. Again, that was a request for information that was 
set at a level that was double the industry average, as I under- 
stand it. 

Mr. Bachus. But in all your testimony you have highlighted com- 
panies that had — 3 percent is not evidence of fraud, is it? 

Mr. Delery. I agree with that. 

Mr. Bachus. Okay. 

Mr. Delery. And we have not viewed it as that. 

Mr. Bachus. Right. 

Mr. Delery. I thinkit was an effort to find information. 

Mr. Bachus. But you are going down to 3 percent, but you admit 
that 3 percent in 1 month is not evidence of fraud. 

Mr. Delery. Not that amount per se. We don’t have a absolute 
threshold for that. 

Mr. Bachus. Okay. Thank you. Well, it is an absolute — I mean, 
it is in your subpoenas, it is 3 percent. 

Mr. Delery. As a request for information, that is correct. 

Mr. Bachus. Well, it is a subpoena, it is a subpoena, it is a legal 
document that the bank has to go out and find all these people. 
You agree that banks like to avoid risk, right? 

Mr. Delery. I mean, that would be my understanding. 

Mr. Bachus. And they avoid it by de-risking. And in this case 
I am not saying you purposefully, personally wanted to have these 
banks jettison these clients, but they are going to avoid risk. You 
send them something, you attach a list of different businesses. 

And it is also interesting that this list from the — I apologize. 
That is Rachel at Card Services. I would love for you all to go after 
them. 

The ones that you highlighted actually in this thing you at- 
tached, and this was a document I guess you all prepared because 
you refer to the FDIC, you just talk about examples. And you use 
tobacco sales, pharmaceutical sales, payday and subprime loans, 
pornography, magazine subscriptions. 

But, General, some that you didn’t include were escort services 
or drug paraphernalia, which was on the original list. So kind of 
interesting that Ponzi schemes, pornography, you didn’t include 
those, you included firearm sales, ammunition sales. Kind of inter- 
esting. How did you highlight that over pyramid schemes, pornog- 
raphy, or escort services? 
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Mr. Delery. So, Congressman, these materials were prepared by 
the FDIC for their own regulatory purposes. And to my knowledge, 
the Department of Justice did not participate in choosing the exam- 
ples. 

Mr. Bachus. When you attach this to your subpoena don’t you 
realize that sends a message? 

Mr. Delery. Well, I think that it is important, if I could, to clar- 
ify again, that doing business with any particular industry, wheth- 
er on a high-risk list of a regulator or not, was not the basis for 
receiving any of the subpoenas. We selected the recipients of the 
subpoenas because we had reason to believe that the recipients had 
evidence of fraud that was being conducted by either a financial in- 
stitution or somebody else against a consumer. And the sources of 
information were prior investigations into fraudulent merchants or 
cooperating witnesses. 

Mr. Bachus. Yeah, I think when you issue a subpoena to a bank 
and you say, we are looking for fraud, and you say, ammunition 
sales, firearm sales, payday lending, you have to acknowledge that 
many banks said they have cut these folks loose. Tobacco sales. 

Mr. Delery. Congressman, I think it is also important to note 
that we have, in response to questions, taken a number of steps to 
make clear to the industry and to the public what we are and are 
not doing. And so, going back to last year, we have met with indus- 
try groups, we have communicated with them, we have written to 
Members of Congress to make clear that doing business with any 
particular industry we don’t view as evidence of fraud. 

And so I do think we take seriously the questions of effects on 
other institutions and have therefore been working publicly and 
with industry to explain what we are and are not doing To avoid 
that kind of result. 

Mr. Bachus. My Democratic colleagues have said they want to 
wrap this up. So let me just simply say to you that this is having 
the effect of shutting down these companies, whether that was in- 
tended or not. So thank you. 

Mr. Johnson. Mr. Chairman? 

Mr. Bachus. Oh, you have another question. Sure. 

Mr. Johnson. I would ask you to yield to me for a couple of ques- 
tions. 

Mr. Bachus. Sure. I am sorry, two questions, or however many 
questions. 

Mr. Johnson. The National Automated Clearing House Network 
Association, which governs the ACH Network through its self-regu- 
latory operating rules, has repeatedly referred to banks as the 
gatekeepers of the ACH Network. Do you agree with that charac- 
terization of banks? Yes or no? 

Mr. Delery. I certainly agree that merchants need access to the 
banking system through a financial institution, if that is what that 
means. I am not familiar with that. 

Mr. Johnson. And the ACH Network connects more than 12,000 
financial institutions while over $40 trillion in value is supported 
annually through the ACH Network representing more than 22 bil- 
lion transactions. And the average rate of returns or chargebacks 
is less than 1.5 percent on the ACH Network. Please discuss 
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whether higher return rates trigger certain diligence requirements 
for banks and payment processors. 

Mr. Delery. Well, certainly, Congressman, I think that among 
the evidence that we look to in evaluating fraud, particularly high 
return rates would be in that category as reflected in the Four 
Oaks case. Again, our cases are based on situations not just where 
a financial institution unwittingly processes a fraudulent trans- 
action, but where they knowingly allow fraudulent merchants to 
access the payment system through their institution or deliberately 
look the other way against evidence of fraud, for example, by hav- 
ing a control in place and then turning it off to avoid seeing the 
answer. And a high return rate could be and has been, for example, 
in the Four Oaks case, evidence of repeated fraudulent with- 
drawals by consumers. 

And I do think it is important to remember that at bottom these 
cases are about fraud against consumers. They started by noting 
the endless variety of fraud, different types of scams that con- 
sumers face all across the country, and by following where the 
money went from those scams to particular banks and payment 
processors that are not following the rules. 

Mr. Johnson. And an indication that the rules are not being fol- 
lowing is a high rate of return. And the industry standard is about 
1.5 percent. Isn’t that correct? 

Mr. Delery. Yes, that is my understanding. 

Mr. Johnson. And the subpoena that my friends from the other 
side keep referring to puts the institution to which the subpoena 
was directed on notice that a 3 percent return rate is something 
that they should pay attention to. 

Mr. Delery. I guess the way I would say it, Congressman, is 
that some of the subpoenas asked for return rates over 3 percent, 
that that would be twice the ordinary average. Again, we did not 
view and do not view that level as evidence of fraud. The type of 
return rates we are talking about in Four Oaks, 30-plus, up to 70 
percent, would be evidence of fraud. 

Mr. Johnson. A 70 percent return rate would certainly authorize 
a civil action against that particular institution. 

And with that I will 

Mr. Bachus. And you have no debate for anyone on that. 

And let me close by saying, the Democratic Senator from Hawaii, 
11 members of Financial Services, Democrats, have written ex- 
pressing their concerns over legitimate businesses being shut down. 

And I will close by just, I want to read this to you, just to say 
go back, consider this. Powder Horn Outfitters sells shooting, arch- 
ery, and fishing equipment in Hyannis, Massachusetts. It was re- 
cently turned down for a loan by its longtime bank. Powder Horn’s 
owner says this. He cites Operation Choke Point. “Our loan was 
turned down not because of our credit. We had perfect financials 
and had been working with the same manager for 20 years. It was 
just because question sell guns, and they said that to us specifi- 
cally, you sell guns.” So it is having that effect. 

Mr. Delery. And, Mr. Chairman, hopefully this hearing, among 
other things, helps to explain our position that that is not the basis 
of the actions that we are bringing. We will continue our efforts to 
make clear what our policy is, which is to pursue fraud. 



120 


Mr. Bachus. Hopefully you will take some of our concerns, like 
this 3 percent and others, into consideration, because I know that 
a lot of companies that are losing their bankers. Three percent in 
1 month. And you said and I have said that in certain industries 
3 percent is not that unusual. There are industries that deal with 
certain demographics, the average is 1.5, there are going to be 
stores in certain areas that are going to have 3, 4 percent, particu- 
larly in 1 month. 

Consumer fraud is real. Go after that, not after an archery store. 
Thank you. 

Mr. Delery. Thank you. 

Mr. Bachus. And you are dismissed. And we appreciate your tes- 
timony and your candor. 

Mr. Bachus. Good morning. So this is our second panel, and we 
have an esteemed group of witnesses, starting out with Professor 
Levitin, Adam J. Levitin, Georgetown University Law Center. 

Professor Levitin is a professor at Georgetown University. That 
pretty much goes without saying, doesn’t it? But he specializes in 
bankruptcy, commercial law, and financial regulation. His research 
focuses on consumer and housing finance payments and debt re- 
structuring. 

He currently serves on the Consumer Financial Protection Bu- 
reau’s Consumer Advisory Board, and he has previously served as 
the Bruce W. Nichols Visiting Professor of Law at Harvard Law 
School, and the Robert Zinman Scholar in Residence at the Amer- 
ican Bankruptcy Institute, and the Special Counsel to the Congres- 
sional Oversight Panel for the Troubled Asset Relief Program. 

Prior to joining the Georgetown faculty, Professor Levitin prac- 
ticed in the Business Finance and Restructuring Department of 
Weil — is that Gotshal? 

Mr. Levitin. Weil, Gotshal. But if you would like to curtail the 
biography. There is no reason everyone here needs to hear it. 

Mr. Bachus. Okay. And Weil, Gotshal & Manges? 

Mr. Levitin. That is right. 

Mr. Bachus. LLP. And served as law clerk to the Honorable 
Jane R. Roth on the United States Court of Appeals for the Third 
District. 

Professor Levitin received his JD from Harvard Law School, a 
masters in — is that philosophy? 

Mr. Levitin. It is actually an M.Phil in history. 

Mr. Bachus. Okay. 

Mr. Levitin. You are going to make my mom very proud. 

Mr. Bachus. And an AM from Columbia University, and an AB 
from Harvard College. His scholarship had won several awards, in- 
cluding the American Law Institute’s Young Scholar’s Medal. 

We welcome you. 

Mr. Scott Talbott, senior vice president of government affairs at 
the Electronic Transactions Association. He is responsible for devel- 
oping and executing ETA’s Federal and State legislative and regu- 
latory strategies on behalf of ETA’s more than 500 member compa- 
nies. 

Prior to joining ETA, Mr. Talbott served senior vice president for 
public policy at the Financial Services Roundtable where he di- 
rected the overall policy strategy, managed the daily legislative and 
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regulatory advocacy efforts, and directed communications. Mr. 
Talbott also served as counsel to the organization and managed the 

Roundtable’s political action committee. 

He has received numerous accolades in his tenure, including 
being named the top lobbyist by the Hill in both 2009 and 2011, 
as well as a winner for his work during the economic collapse of 
2008 by the Washingtonian magazine. 

In 2010 he appeared in the Oscar winning film “Inside Job.” So 
you are a movie star, right? How about that. I didn’t know that, 
Scott. Once named NPR’s favorite bank lobbyist. He is a frequent 
contributor to both national and international media. 

He joined the Roundtable in 1994 after working in the tax de- 
partment’s of Arthur Anderson and Ernst & Young. He received his 
BA from Georgetown University cum laude and his JD from George 
Mason University School of Law. So we have two Georgetown pro- 
fessors and a student. 

Mr. David H. Thompson, managing partner, Cooper & Kirk. Mr. 
Thompson is a managing partner at that firm and joined the firm 
at its founding. Mr. Thompson has extensive trial and appellate ex- 
perience in a wide range of matters. In commercial matters Mr. 
Thompson has had significant trial experience in litigating large 
claims for plaintiffs and defendants. 

Serving as the de facto general counsel to several private compa- 
nies, Mr. Thompson has developed significant practical business ex- 
perience. Mr. Thompson has taken hundreds of depositions of sen- 
ior executives, expert witnesses, high-ranking government and uni- 
versity officials, employees, and union leaders. 

So you know how much subpoenas can cost, right? 

Mr. Thompson. Yes, sir. 

Mr. Bachus. Thank you. 

Mr. Thompson also has extensive experience in constitutional 
litigation. Mr. Thompson has litigated numerous cases involving 
freedom of speech, civil rights, voting rights, taking of property, 
Second Amendment and separation of powers issues. 

Ah, Mr. Thompson also served as an adjunct faculty member at 
Georgetown University Law Center and a visiting professor at the 
University of Georgetown Law School, D.C. campus. 

Mr. Thompson received his AB degree magna cum laude from 
Harvard University and received his JD degree cum laude from 
Harvard Law School. 

All right, we finally have a witness that doesn’t have a George- 
town, Harvard background here. 

Our last witness is Mr. Peter G. Weinstock? 

Mr. Weinstock. Weinstock, yes, sir. 

Mr. Bachus. Weinstock. A partner at Hunton & Williams LLP. 
His practice focuses on corporate and regulatory representation of 
small to large regional and national financial institution franchises. 

During the past several years Peter has devoted substantial time 
to regulatory law enforcement and internal investigations of finan- 
cial institutions. He is co-practice group leader of the Financial In- 
stitutions Section. He has counseled institutions on more than 150 
M&A transactions, as well as provided representation on security 
offerings and capital planning. 
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Mr. Weinstock has authored numerous articles in bank publica- 
tions. His article “Acquisitions of Failed Banks Present Risk and 
Opportunity” was honored by the RMA Journal in 2011. He has 
spoken at over 150 banking conferences and seminars and is recog- 
nized at a top speaker and writer in his field. 

He received his BA from State University of New York and his 
J.D. From Duke University School of Law. He is a member of the 
Texas Bar. 

Mr. Weinstock. Better basketball, Mr. Chairman, than George- 
town University. 

Mr. Bachus. You did what? 

Mr. Levitin. Object. 

Mr. Weinstock. Better basketball than Georgetown University. 

Mr. Bachus. At Duke. That is right. Georgetown is kind of a 
whipping boy for Duke. Recently. All right. 

Each of our witnesses’ written statements will be entered into 
the record in its entirety. 

And I am not going to ask you to restrict it just to 5 minutes. 
So if you want to take a little longer, don’t feel rushed. But, any- 
way, you will see a light will turn red and kind of begin to wrap 
it up then. 

All right. At this time Mr. — Professor Levitin, we will start with 
you. 

TESTIMONY OF ADAM J. LEVITIN, PROFESSOR OF LAW, 
GEORGETOWN UNIVERSITY LAW CENTER 

Mr. Levitin. Good morning, Mr. Chairman Bachus, Ranking 
Member Johnson, and Members of the Subcommittee. Thank you 
for inviting me to testify today. 

Criticism of Operation Choke Point reflect a lack of under- 
standing of payment systems, in general, and the Automated 
Clearing House, or ACH, payment system in particular. 

Critics of Operation Choke Point claim that the Department of 
Justice has overstepped its legal authority under FIRREA, which 
is predicated on crimes that affect Federally insured financial insti- 
tutions. 

Operation Choke Point’s critics claim that consumer frauds do 
not affect financial institutions. They are wrong. When a bank 
transmits a payment request in the ACH system, the bank war- 
rants that the request was authorized by the consumer and that 
the requester complies with the laws of the United States. 

This means that banks are vouching for the legitimacy of the 
payments in the ACH system. When payments turn out to be un- 
authorized or illegal, banks have liability. A similar situation exists 
for credit and debit card payments where banks are on the hook 
for chargebacks that merchants are unable or unwilling to pay. 

Consumer fraud very much affects Federally insured financial in- 
stitutions. Accordingly, Operation Choke Point is squarely within 
the Department of Justice’s statutory authority under FIRREA. 

Now, you may hear that the Department of Justice is abusing 
the concept of reputational risk. But I would note that there is a 
single mention of reputational risk in the only complaint filed in 
Operation Choke Point, that — the complaint against Four Oaks 
Bank. 
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Whatever issues there are with the concept of reputational risk, 
they do not at this point appear to be part of Operation Choke 
Point, and I think we should be very careful not to conflate the De- 
partment of Justice’s civil investigation of specific fraud with other 
regulatory activity by prudential regulators. I think it is important 
that we keep them separate. 

Critics of Operation Choke Point have also argued that the De- 
partment of Justice is trying to shut down legitimate, but 
disfavored, industries. This concern is unfounded. 

Operation Choke Point focuses on banks that choose to process 
transactions that they know are fraudulent or that willfully ignore 
clear evidence of fraud. Operation Choke Point is about ensuring 
the banks comply with their anti-money laundering operations. 

The basis for the Department of Justice’s suit against Four Oaks 
Bank was that Four Oaks did not have reasonable controls in place 
and ignored the presence of really glaring red flags indicating ille- 
gal activity. 

That said, there are objective measures of industries with higher 
consumer fraud rates, namely, the rate of ACPI transactions that 
are returned as unauthorized. When dealing with these industries, 
banks cannot be lax in anti-money laundering compliance, and they 
may need to conduct further diligence. 

Now, this does not mean that banks need to look through every 
image on a customer’s porn Web site to see if there is child pornog- 
raphy or examine every payday loan for a Military Lending Act vio- 
lation or ensure that every firearm sold by a customer is not sold 
to a convicted felon. 

But banks do need to take reasonable steps to determine that 
their customer is doing a legitimate business and these are legiti- 
mate industries, but banks have to verify what the business actu- 
ally is and not to ignore red flags like high unauthorized trans- 
action return rates, high volumes of consumer complaints, or false 
representations of U.S. domiciles, was the case in Four Oaks Bank. 

This is not making the banks cops. Instead, it is just empha- 
sizing that banks cannot willfully turn a blind eye to illegal activ- 
ity. 

Concerns about spillover effects are also overstated. There are 
anecdotes, but no verified evidence of Operation Choke Point affect- 
ing legitimate businesses. There are no verified cases of banks ter- 
minating customer accounts because of Operation Choke Point. 

Payday lenders have been having problems with bank account 
terminations for over a decade. In 2006, payday lenders testified 
about this to Congress. This is a problem that predates Operation 
Choke Point. 

But even if Operation Choke Point were resulting in account ter- 
minations, it is not clear why this would be a problem, per se. 
Compliance with anti-money laundering regulations has costs, and 
that is especially true in dealing with high-risk businesses. Some 
banks may very well rationally decide that it isn’t worthwhile to 
serve these businesses. 

For other banks, however, Operation Choke Point is a business 
opportunity. Some of our nearly 7,000 banks will serve these high- 
risk businesses, but they will do so at a higher price, and this is 
just the free market at work. 
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In other words, Operation Choke Point might result in higher 
costs of banking services for higher risk merchants. There is noth- 
ing wrong with that. Banks should be pricing for risk, and high- 
risk merchants should have to pay their own freight. 

The thing is high-risk merchants don’t want to pay higher costs. 
They would rather be subsidized by getting a pass from anti-money 
laundering laws. And that is what they are here asking you for. 

There is no reason that we should be subsidizing high-risk busi- 
nesses like escort services, payday lenders, pornographers, or pur- 
veyors of racist material. Yet, pressuring the Department of Justice 
to back off Operation Choke Point is an attempt to subsidize these 
high-risk businesses, and it is an attempt to do so that comes at 
the expense of homeland security. Congress shouldn’t be doing 
that. 

Operation Choke Point is a legitimate exercise of the Department 
of Justice’s authority under FIRREA to investigate and prosecute 
frauds affecting Federally insured financial institutions. Banks 
need to take their anti-money laundering responsibilities seriously. 
Operation Choke Point should be applauded, not criticized. 

Thank you. 

[The prepared statement of Mr. Levitin follows:] 
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Mr. Chairman Bachus, Ranking Member Johnson, Members of the Subcommittee: 


Good morning. Thank you for inviting me to testify at this hearing. My name is 
Adam Levitin. I am a Professor of Law at the Georgetown University, where I teach 
courses in financial regulation and structured finance, among other topics. 1 also serve on 
the Consumer Financial Protection Bureau’s statutory Consumer Advisory Board. 
Among other publications, T am a co-author of the National Consumer Law Center’s 
treatise of Consumer Banking and Payments Law (5 th ed. 2013), and am the primary 
author of that treatise’s materials on Automated Clearing House (ACH) transactions. 1 
am here today as one of the few academics in the United States who writes and teaches 
about the ACH system; I am not testifying on behalf of the CFPB or its Consumer 
Advisory Board. 

The fuss over the Department of Justice’s Operation Choke Point reflects a 
fundamental lack of understanding of the operation of payment systems. Operation 
Choke Point aims to reduce consumer fraud by ensuring that banks that provide payment 
intermediary services comply with their existing legal obligations under the Bank 
Secrecy Act and Anti-Money Laundering regulations. Critics of Operation Choke Point 
argue that the Department of Justice is overreaching it is use of the Financial Institutions 
Reform, Recovery, and Enforcement Act (F1RREA) because the consumer frauds 
targeted by Operation Choke Point do not “affect” financial institutions as required by 
F1RREA 

Critics of Operation Choke Point fail to recognize, however, that the banks in the 
ACH system warrant the authorization and lawfulness of the transactions they initiate. 
This means that the banks assume liability themselves when handling fraudulent requests 
for payment. Moreover, banks’ that fail to adequately supervise their customers risk 
expulsion from the ACH system under that system’s private rules; few banks can operate 
competitively without access to the ACH system. Accordingly, use of the ACH system 
for consumer fraud very much “affects” banks. Banks’ direct financial exposure means 
that the Department of Justice is squarely within its grant of authority when bringing 
prosecutions under FfRREA. 

It is not a new idea that banks need to have adequate controls and risk 
management, particularly in regard to the oversight of third-party payment processors 
that serve as agents for ACH payees. Prudential bank regulators have for years 
emphasized the need for such oversight in regulatory guidance, as has the private bank 
membership organization that sets the rules for the ACH system. 2 Third-party payment 
processors raise particular money laundering and payment warranty risks for banks when 
banks do not know the customers of the third-party payment processors and cannot verify 
that the customers are engaged solely in legitimate business. Indeed, bank regulators 
have repeatedly brought enforcement actions when banks have failed to adequately 


1 See, e.g., FD1C, Managing Risks in Third-Party Payment Processor Relationships, Supervisory 
Tnsighls, Summer 2011: OCC, Bulletin 2006-39, Automated Clearing 1 louse Activities, Sept. 1 . 2006. 

2 NAC11A, Third-Party Sender Case Studies: ODPI Best Practices to Close the Gap , An AC11 
Risk Management White Paper (2009). 
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ensure the integrity of the payment system by failing to properly oversee third-party 
payment processors. 3 

When banks do not know their customers or, in the case of third-party payment 
processors (which are really pass-through entities), their customers’ customers, there is 
an inherent risk of money laundering. Operation Choke Point is insisting that banks take 
their anti-money laundering responsibilities seriously. While Operation Choke Point is 
aimed at consumer fraud, the same controls necessary to ensure that the ACH system is 
not used to facilitate consumer fraud also ensure that it is not used to facilitate narcotics 
trafficking or financing for terrorism. The Department of Justice should be lauded, not 
lambasted, for its efforts to make sure that banks take their anti-money laundering 
responsibilities seriously. 

If we want to ensure that our financial system is not used to facilitate evasion of 
US laws and terrorism financing, it is imperative that banks rigorously adhere to anti- 
money laundering rules, such as the “know your customer” requirement, and that anti- 
money laundering regulations not be undercut by use of third-party payment processors 
that mask the identity of the ultimate customer. 

Attempts to hamper the Justice Department’s enforcement of anti-money 
laundering laws are effectively a subsidy to high-risk businesses. When banks are not 
required to fulfill their anti-money laundering obligations, it enables risky merchants to 
avoid paying for the higher compliance costs they impose on banks. Congress should not 
be using its oversight power to subsidize high-risk businesses, such as payday lenders, 
on-line gun shops, escort services, on-line gambling parlors, purveyors of drug 
paraphernalia or racist materials, and pomographers, that serve no clear public purpose, 
much less at the expense of homeland security. 

I. Understanding the ACH System 

The automated clearing house or ACH is an electronic payment method for 
moving funds between accounts at depository institutions. ACH is one of the largest 
payment methods for business and consumer transactions. In 2013, there were nearly 22 
billion ACH transactions for nearly $39 trillion performed in the United States. 4 Despite 
the volume of ACH payments, ACH remains one of the least familiar payment systems to 
consumers because it does not have a distinctive retail fapade because ACH transactions 
do not require a special access device like a check or payment card. Instead, they merely 
require a transmission of a bank account and routing number, which can be done orally, 
in print, or electronically. 


3 See, e.g., FD1C, Consent Order FDlC-10-845b, hi the Matter of SunP'irst Bank, St. George, Utah, 
Nov. 9, 2010; OCC, Consent Order, In the Matter of Wachovia Dank, Nat ’l Ass ’n, Charlotte, North 
Carolina, AA-EC-10-1 7, Mar. 12, 2010 ($50 million civil monetary penalty; FinCTvN, Assessment of Civil 
Monetary Penalty. In the Matter of: Wachovia Bank, Nat 7 Ass ’n, Charlotte, North Carolina, Number 
2010-1, Mar. 12, 2010 ($110 million civil monetary penally); IJ.S. v. Wachovia Bank, N.A., Deferred 
Prosecution Agreement, No. 10-20 165-CR-LENARD (S.D. Fla., Mar. 16, 2010); U.S. v. First Bank of 
Delaware, No. 12-6500 (R.D. Pa.) ($15 million civil monetary penalty and surrender of bank charter); 
FD1C, Consent Order FDlC-12-367b, In the Matter of Meridian Bank, Paoli, Pennsylvania , Oct. 22, 2012. 

4 NACHA, ACH Network Statistics 2013. 
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Different rules govern consumer and business ACH transactions. ACH 
transactions involving consumers are governed by a combination of the Electronic Funds 
Transfer Act and Regulation E thereunder and the rules of the National Automated 
Clearing House Association (NACHA), a not-for-profit membership association of banks 
that sets the standards for ACH operations in the United States. ' Business-to-business 
ACH transactions are governed by NACHA rules and contract law; NACHA rules are 
somewhat different for business-to-business ACH transactions than for consumer 
transactions. 

A. Parties to an ACH Transaction 

Structurally, an ACH transaction looks much like debit card or credit card 
transaction. An ACH transaction involves (at least) five parties: an Originator, an 
Originator’s depository financial institution (ODFI), an ACH Operator, a Receiver, and a 
Receiver’s depository financial institution (RDFI). Sometimes there will also be a Third- 
Party Payment Processor (TPPP) involved as well, which serves as an agent for the 
Originator. 

Both the ODFI and RDFI are always banks. The Originator (or TPPP, if one is 
involved in the transaction) has a bank account at the ODFI, while the Receiver has a 
bank account at the RDFI. The ODFI and RDFI each have accounts with the ACH 
Operator. There are only two ACH Operators in the United States: the Federal Reserve 
System’s FedACH and the Clearing House’s Electronic Payments Network. 

B. How an ACH Transaction Works 

In an ACH transaction, the Originator instructs the ODFI to submit a debit or 
credit instruction to the ACH Operator. The ACH Operator transmits the instruction to 
the RDFI, which will then credit or debit the Receiver’s bank account. An ACH 
transaction can be either a credit or debit transaction, meaning that it can involve the 
Receiver’s bank account being credited or debited. Irrespective of whether the 
Receiver’s account is credited or debited, data flows are the same in all ACH 
transactions, and explain the ACH system’s terminology: data flows always start with 
the Originator and end with the Receiver. In an ACH credit transaction, the data and 
funds move the same direction, from Originator to Receiver, while in an ACH debit 
transaction, the data flows from Originator to Receiver, but the funds flow the opposite 
direction. Because Operation Choke Point involves only ACH debit transactions, in 
which the Receiver’s account is debited, I will focus on these transactions; somewhat 
different rules apply to ACH credit transactions, such as direct deposit . 6 

An ACH debit transaction involves an instruction to pull funds from a deposit 
account, whereas an ACH credit transaction involves an instruction to push funds from a 
deposit account. In an ACH debit transaction, the Originator (the payee) directs the 
ODFI to request that the RDFI transfer funds from the account of the Receiver (the 
payor) at the RDFI. In order to do so, the Receiver must have authorized the transaction. 
After obtaining the Receiver’s authorization, the Originator transmits the transaction 

5 NACHA Rules arc a private set of industry self -regulatory rules, adopted by cither a 3 /t vote of 
NACHA members of a 2/3 weighted transaction volume vote of NACHA members. In other words. 
NAC11A Rules are rules that banks themselves think are necessary. 

6 NACHA 2013 Operating Guide at OG2. 
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information, including the Receiver's bank routing and account number to the ODFI 
The ODFI then formats this information into an electronic file (an ACF1 file). The ODFI 
will then transmit the ACH file to the ACH Operator, which will transmit it to the RDFI. 
which will debit the account of the Receiver (i.e, the payor), transmit the funds to the 
ACH Operator, which will credit the ODFI's account, with the ODFI then settling the 
funds into the Originator’s account at the ODFI. 7 Figure I, below, illustrates an ACH 
debit transaction 

Figure 1. ACH Debit Transaction 


Originator (Merchant) Receiver (Consumer) 



ODFI y ACH Operator v RDFI 


To illustrate, consider an ACH debit transaction to collect a payday loan. In this 
transaction, the payday lender is the Originator, and the consumer is the Receiver The 
payday lender’s bank is the ODFI. and the consumer’s bank is the RDFI If the payday 
lender has received authorization for an ACH debit from the consumer, the payday lender 
may instruct its bank (the ODFI) to transmit an ACH debit item to the consumer’s bank 
(the RDFI) through the ACH Operator If there is money in the consumer's account, the 


ACH l.x u hatch processing system, which means that individual transactions arc not processed in 
real time Instead, the ( >D1*1 accumulates ACM transactions and sorts them by destination for electronic 
transmission to the AC1 1 Operator at a predetermined time. NACHA Operating Guide 2013. at OGI The 
transactions hatched in a particular time period are netted out by the ACM Operator among the various 
ODFIs and RDFls in the sy stem The butch processing creates economies of scale as compared to the 
alternative of real time gross settlement such as is used in Fed Wire wire transfers (the continuous 
settlement of individual funds transfers on an order by order basis without netting) 
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consumer's bank will debit the account and transfer the funds to the payday lender’s bank 
through the ACH Operator. 

C. ACH Returns 

If there is no money in the consumer’s account, the ACH debit item will be 
“returned.’’ An ACH “return ” item is separate and distinct from a return of merchandise 
paid for via ACH. Thus, a firm like Zappos, which sells shoes and other merchandise on- 
line, has a high rate of returns, but this does not mean that Zappos has a high ACH return 
rate. If a customer pays for shoes from Zappos via ACH and then returns shoes to 
Zappos, there is not normally an ACH return. Instead, Zappos would return the funds via 
an offsetting ACH credit. 

Similarly, if it turns out that the consumer did not authorize the ACH debit and 
promptly notifies its bank after the funds have been debited, then the consumer’s bank 
will “return” the ACH debit item and look to be reimbursed by the payday lender’s bank 
for the funds that were improperly debited from the consumer’ bank account. The 
consumer’s bank will have a right to the funds from the payday lender’s bank because the 
payday lender’s bank has warranted that the transaction was authorized, that the 
transaction complies with NACHA Rules, including that the ACH entries do not “violate 
the laws of the United States,” and indemnified the consumer’s bank for any costs arising 
from an unauthorized transaction. 8 The payday lender’s bank will be on the hook for 
these funds; it will have the right to recover them from the payday lender, but if the 
payday lender is out of business or insolvent, the payday lender’s bank will bear the loss. 
The important point to see here is that the payday lender’s bank is vouching for the 
transaction and may be liable for it. 

D. Third-Party Payment Processors 

Some ACH transactions involve a Third-Party Payment Processor (TPPP). A 
TPPP serves as an agent for the Originator. The Originator will transmit the transaction 
information to the TPPP, which will in turn transmit the information to the ODFI. In 
some cases, TPPP are allowed to have direct access to the ACH Operator for debit 
transactions. 9 Figure 2, below, illustrates an ACH debit transaction involving a TPPP. 

There are legitimate uses of TPPP, which have specialization and technical 
capacities many Originators lack. The use of TPPPs began in the context of payroll 
management firms that were making ACH credit transactions (direct deposit), where 
funds were being transferred to consumers’ accounts. ACH debit involves transfers from 
consumers’ accounts and raises concerns about whether the transactions are authorized. 

NACHA Rules aim to ensure the integrity of the ACH payment system and the 
trust and confidence of its users. Accordingly, NACHA Rules require ODFIs to monitor 
Originators’ or TPPP’s return rates for unauthorized transactions. NACHA Rules 
currently have a 1% threshold for unauthorized transaction return rates; a pending 
proposal would lower the threshold to 0.5%. 10 


8 NACHA Rules 2.4. 1 (ODFI warranties to RDFT); 2.4.4 (ODFI indemnification ol'RDFT). 

9 NACHA Rule 8.2.2. 8. 

19 NACHA Rules 2. 17.2.1, 10.2.1. 
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Figure 2. ACH Debit Transaction with Third-Party Payment Processor 



If an unauthorized transaction return rate exceeds 1%, then within 10 banking 
days the ODFI must submit to NACHA various information about the Originator or 
TPPP submit a plan for reducing the return rate to no more than 1% within thirty days 
and must in fact achieve such a reduction and maintain it for an additional 180 days " If 
the ODFI fails to do so, it is subject to fines or suspension by NACHA. 13 NACHA fines 
and NACHA suspension, in particular, present a material risk for ODFIs As a result, 
ODFls will often simply terminate their business relationship with Originators whose 
unauthorized transaction return rales exceed the 1% threshold 

Because Originators with high unauthorized return rates risk being cut out of the 
ACH system, they often seek to use TPPPs to mask their return rales. TPPP typically 
serve multiple Originators Because the return rate for a TPPP with multiple Originators 
is the transaction weighted average return rate of all of its Originators, an Originator that 
uses a TPPP can have an unauthorized transaction return rate that exceeds the NACHA 
threshold if the TPPP also serves Originators with low return rates. Thus, the use of 
TPPPs enables Originators with high unauthorized transaction return rates to maintain 
access to the ACH system. NACHA has recognized this risk and since July 18, 2010 has 


" NACHA Rules 2, 1 7,2. 1: 2.17.2.2 
NACHA Rules 10 2 2 
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required that ODFI’s contracts with TPPPs include provisions that give the ODFI the 
right to terminate or suspect the contract or to terminate or suspend any Originator of the 
TPPP 

II. The Department of Justice’s FIRREA Authority 

Section 951(g) of the Financial Institutions Reform, Recovery, and Enforcement 
Act of 1989 (FIRREA) authorizes the Department of Justice to issue subpoenas to 
investigate potential wire fraud “affecting a federally insured financial institution”. 13 
This is exactly what the Department of Justice has done as part of Operation Choke 
Point 

As the controversy over Operation Choke Point appears to be centered on whether 
illegal or unauthorized ACH transactions are “affecting a federally insured financial 
institution” rather than on whether the predicate elements of wire fraud exist, my 
testimony is limited to the “affecting a federally insured financial institution” issue. As a 
starting matter, case law is clear that a bank is affected when there is merely “a new or 
increased risk of loss”; courts have uniformly held that an actual loss is not required by 
FIRREA. 14 

Critics of Operation Choke Point contend that payments on illegal or 
unauthorized underlying transactions affect only merchants and consumers, not financial 
institutions. They are wrong. Such a contention shows a fundamental lack of 
understanding of payment systems in general, and of the details of the ACH system in 
particular. Critics of Operation Choke Point simply do not understand how the ACH 
system operates and lack familiarity with the NACHA Rules that provide the legal 
framework for ACH transactions. 

All non-real time payment systems involve credit risk for the banks that serve as 
intermediaries between payors and payees. If a transaction is reversed or refused, a bank 
can find itself a creditor of payor or payee, and if the payor or payee is insolvent, then the 
bank will take the loss. While the dollar amount for any single transaction may not be 
large, the cumulative exposures can be material. 

ODFI banks in the ACH system expressly assume credit risk because they warrant 
the authorization and rules compliance of all ACH debit entries, including that the entry 
is not in violation of the laws of the United States. While the ODFT banks may be 
indemnified by or have upstream warranties from the TPPPs or Originators, these 
indemnities and warranties are only as good as the credit of the TPPP or Originator. In 
other words, ODFIs are assuming credit risk on illegal or unauthorized ACH transactions. 
Thus, illegal or unauthorized ACH transactions are plainly “affecting a federally insured 
financial institution”. Moreover, ODFIs that serve Originators or TPPPs with excessive 


11 12U.S.C. § 1 833a(a), (c), (g); 18U.S.C. § 1343 (wire fraud). 

1 See. e.g., United Stales v. Serpico. 320 F.3d 691 (7th Cir. 2003); United States v. Mullins, 613 
1. 3d 1273 (10th Cir. 2010); United States v. Ghavami , 2012 U.S. Dist. Lexis 97931 (S.D.N.Y. July 13, 
2012); T3ank of N.Y. Mellon, 941 l 7 . Supp. 2d 438 (S.D.N.Y. 2013); United States v. Wells Fargo Hank , 
N.A. , 972 F. Supp. 2d 593 (S.D.N.Y. 2013); United States v. Countrywide Fin. Corp ., 2014 U.S. Dist. 
Lexis 19985 (S.D.N.Y. Feb. 17,2014). 
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unauthorized transaction returns risk being fined or suspended by NACHA, which would 
mean being cut out of the ACH system and unable to send or receive ACH items. Again, 
illegal or unauthorized ACH transactions are plainly “affecting a federally insured 
financial institution”. 

Thus, to the extent that an underlying consumer fraud utilizes ACH system, it is 
using a wire communication as part of a scheme or artifice to defraud, or for obtaining 
money or property by means of false or fraudulent pretenses with the intent to defraud. 
When an ODFI bank knowingly participates in such a scheme, it too is engaged in a wire 
fraud. The use of the ACH system to facilitate wire fraud necessarily “affects” the ODFI 
banks used by the fraudsters because the ODFI banks warrant the authorization and 
lawfulness of the transactions in the ACH system. This means that the fraudsters’ ODFI 
banks are themselves potentially on the hook for the transactions. Moreover, ODFI 
banks that fail to adequately supervise their customers may be suspended from the ACH 
system. Because such consumer frauds to “affect” banks by posing real and material 
financial risk to them, it is appropriate for the Department of Justice to bring enforcement 
actions under FIRREA. 

III. Account Terminations as a Result of Operation Choke Point 

The Department of Justice’s investigation into the use of the ACH payment 
system to facilitate consumer fraud has unquestionably encouraged banks to reexamine 
their Bank Secrecy Act/ Anti-Money Laundering compliance, as well as their NACHA 
Rules compliance. In some case this might have resulted in banks deciding it was more 
cost effective to terminate business relationships than to undertake the necessary steps to 
ensure that the relationship was in compliance with the necessary legal requirements. It 
bears emphasis, however, that there are no verified cases of banks terminating accounts 
in direct reaction to Operation Choke Point : merely because an account was tenninated 
after the commencement of Operation (’hoke Point does not mean that there was a causal 
connection, even if the account holder was in a “high risk” business. 14 Indeed, high-risk 
merchants have been having their accounts terminated since well before Operation Choke 
Point. 

Even if banks have been terminating high-risk (but legal) accounts in response to 
Operation Choke Point, there is no reason for Congressional intervention. Such account 
terminations are nothing more than the normal operation of the free market. All markets 
are legally constituted and regulated. Legal compliance has costs; there is a cost to 
having anti-money laundering laws. Just as banks need to ensure that they are not 
providing payment services for drug dealers and terrorists, they also need to make sure 
that they are not providing payment services for child pornography transactions or for 
gun sales to convicted felons. If the cost of legal compliance is greater than the benefit to 
a bank from a customer relationship, the bank will rationally terminate the customer 
relationship. 

Unless one believes that there is a serious market failure in the provision of 
business banking services, some of the nation’s nearly 16,000 banks and credit unions 


1 See, Dana T.iebelson, Is Obama Really Forcing Banks to Close Porn Stars ' Accounts ? hio, Says 
Chase Insider, Mother Jones, May 8, 2014, at http://www.m otheri on es.com /politi cs/2 014/05/operation- 
chokcpoint4aanks-rx)m-stars . 


C 2014, Adam ,T. Levitin 



135 


11 


will be willing to assume these high-risk businesses as customers... if these high-risk 
customers are willing to pay enough to cover banks’ costs of servicing them in full legal 
compliance. Therefore, Congressional pressure on the Department of Justice to tenninate 
Operation Choke Point is functionally providing a subsidy to high-risk businesses by 
allowing them to avoid the higher fees banks will charge in order to cover their additional 
costs of complying with anti-money laundering regulations for the high-risk businesses. 

It bears emphasis that the account terminations are the result of banks making 
rational decisions about the costs of legal compliance; they are not at the directive of the 
Department of Justice. The Department of Justice’s consent order with Four Oaks Bank 
does not prohibit Four Oaks Bank from dealing with payday lenders or from dealing with 
TPPPs that deal with payday lenders. Instead, it prohibits Four Oaks Bank from dealing 
with TPPPs that have in the past two years serviced payday lenders with high return rates 
for unauthorized transactions, data quality, or total returns. All the Department of Justice 
is doing is its job — enforcing FIRREA and the Bank Secrecy Act/Anti-Money 
Laundering regulations. Access to the financial system is a privilege, not a right, and it is 
given federal insurance of the financial system, it is reasonable to demand that banks that 
fail to institute proper risk management controls exclude high-risk customers from the 
system. 

IV. The Supposedly Slippery Slope 

Critics of Operation Choke Point have raised a straw man argument that 
Operation Choke Point is the first step in shutting down legitimate, but politically 
disfavored businesses: today the payday lenders, tomorrow the gun shops and 
pornographic websites, the next day the abortion clinics or the Tea Party . . . . 15 

T his slippery slope argument is flawed. The industries that have been flagged as 
high-risk merchant categories are so-flagged because of they have high unauthorized 
transaction rates, using objective metrics . While critics of Operation Choke Point claim 
that it is affecting legitimate coin dealers, on-line gun shops, and pornographers, these 
critics ignore the undisputed fact that coin dealers, on-line gun shops, and pornography 
websites have high unauthorized transaction rates. 16 

The categorization of merchant groups such as coin dealers, on-line gun shops, 
on-line gambling, escort services, purveyors of drug paraphernalia or racist materials, and 
pornographers as high-risk is not simply a matter of regulatory fiat. Instead, it is 
reflected in the price terms that the free market sets. Banks already charge these 
merchants much higher fees for banking services precisely because of the risks they pose. 
For example, pornography websites might pay 15% of a transaction amount to their bank 
to accept a credit card payment because of a high percentage of their transactions are 
disputed: “I didn’t subscribe to that smut! I’m a happily married man!” In contrast, a 


15 See, e.g.. Todd Zywicki, “Operation Choke Point,” Volokh Conspiracy, May 24, 2014, al 
http ://www. washinytonDost.com/news.-yolokh-consDiracv/wi3/20l4/u5/24/operation-choke-point/ . See also 

16 These businesses are often high risk because of consumer fraud, rather than merchant fraud, but 
both can exist. These businesses may be high risk because of consumer fraud because consumers will 
“pay” for the transaction and obtain the merchandise, hut Lhen dispute that the transaction was aulhori/ed. 
In other words, consumers' fraud on merchants, as well as merchants' frauds on consumers may be 
responsible for high unauthorized transaction rates. 
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low-risk business such as Wal-Mart might pay around l%-2% of a credit card 
transaction. 

If abortion clinics and the Tea Party — or any other party initiating ACH debit 
transactions — have high unauthorized transaction rates, it would be legitimate for 
regulators to pay more attention to TPPPs that service them and to insist that banks verify 
their identity and the legitimacy of their businesses. NACHA’s 1% unauthorized 
transaction return threshold — a threshold set by a supermajority vote of NACHA’s bank 
members and not by federal regulators — presents an objective measure of risk that is not 
susceptible to manipulation for political vendettas. 

If and when federal regulators pressure banks to cease doing business with 
legitimate, low-risk businesses, there would be cause for concern. That has not happened 
yet. Instead, what has happened is that legitimate, but high-risk businesses have found 
themselves having to internalize the costs of their own risky business models because the 
Department of Justice has insisted that banks fulfill their obligations under the anti- 
money laundering regulations. Rather than paying their own freight, however, these 
high-risk businesses have run to Congress complaining about Operation Choke Point and 
asking Congress to use its oversight authority to get the Department of Justice to back 
off. 

Make no mistake about it: these high-risk businesses are in effect seeking a 
subsidy from Congress by seeking to be effectively exempted from anti-money 
laundering laws. It is shocking that Congress would even humor such a request. 
Homeland security should not be compromised in order to subsidize high-risk businesses 
like payday lenders, escort services, on-line gun shops, on-line gambling parlors, 
purveyors of drug paraphernalia or racist materials, and pornographers. 

V. Banks as “Policemen” 

Some critics of Operation Choke Point have objected to banks being dragooned 
into the role of “policemen”. 1 ' This objection is off base. Operation Choke Point does 
not force banks to be the “policemen” of the financial system. Instead, it insists that 
banks have in place reasonable controls and that they do not willfully ignore evidence of 
illegal transactions. 

Banks are not like other businesses. They are public instrumentalities. Banks 
receive special (and limited) charters and federal insurance that shelter them from 
competition and subsidize their risk-taking. The deal for receiving these privileges is 
serving public purposes. Ultimately we do not ask a lot from banks: fair lending, 
community reinvestment, and anti-money laundering diligence. 

Operation Choke Point is ultimately an anti-money laundering enforcement that 
requires that banks take their “Know Your Customer” duty seriously. Banks that deal 
with TPPPs must look through them to the ultimate Originator of an ACH transaction, 
just as they would be expected to look through an Originator’s corporate shell to 
determine a client’s real business. Ultimately, this is a matter of having reasonable 
processes, not perfect results. The basis for the Department of Justice’s suit against with 


1 ' Frank Keating, Justice Puts Banks in a Choke Hold. Wall St. J., April 24, 2014. 
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Four Oaks Bank was that it did not have reasonable controls in place and ignored the 
presence of red flags indicating potential illegal activity. 

Operation Choke Point does not demand that banks to evaluate every image on a 
pornography website for child pornography or every loan from a payday lender for 
violation of the Military Lending Act or state law. But banks do need to take reasonable 
steps to determine that the Originator is doing a legitimate business and not ignore red 
flags like high unauthorized transaction return rates or high volume of consumer 
complaints that mandate further diligence. This is not making the banks cops; instead, it 
is just emphasizing that banks cannot willfully turn a blind eye to illegal activity. 

Conclusion 

Operation Choke Point is a legitimate exercise of the Department of Justice’s 
authority under FIRREA to investigate and prosecute wire frauds affecting federally 
insured financial institutions. Unauthorized ACH transactions, such as those in consumer 
frauds, pose direct financial risk to federally insured banks. The concerns that Operation 
Choke Point will be used to shut down legitimate businesses are unfounded. Instead, 
Operation Choke Point will ensure that banks take their anti-money laundering 
responsibilities seriously. Operation Choke Point should be applauded, not criticized. 

When banks are required to fulfill their obligations under the anti-money 
laundering laws, high-risk industries that impose greater compliance costs on banks may 
find it costlier to obtain banking services. This is the cost of having anti-money 
laundering laws. There is no reason that Congress should subsidize high-risk businesses 
that serve no public purpose such as the purveyance of drug paraphernalia or racist 
materials, on-line gun shops, payday lenders, and pomographers, much less at the 
expense of homeland security. Surely homeland security should come before drugs, on- 
line gun purchases, racism, payday loans, and pornography. 
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Mr. Bachus. Thank you. 

Mr. Talbott. 

TESTIMONY OF SCOTT TALBOTT, SENIOR VICE PRESIDENT OF 

GOVERNMENT AFFAIRS, THE ELECTRONIC TRANSACTION 

ASSOCIATION 

Mr. Talbott. Chairman Bachus, Ranking Member Johnson, 
Members of the Subcommittee, my name is Scott Talbott. I head 
up government affairs for the Electronic Transactions Association. 
ETA appreciates the opportunity to participate in the Subcommit- 
tee’s hearing on the Operation Choke Point. 

ETA is an international trade association representing companies 
primarily involved in all aspects of electronic payments. We focus 
on credit cards, debit cards, and prepaid cards. In 2013, we proc- 
essed over 100 billion transactions for about $5 billion worth of 
goods and services. We are the choke in Choke Point. 

In summary, the ETA strongly supports vigorous enforcement of 
existing laws and regulations to prevent fraud, but we believe that 
Operation Choke Point is the wrong execution of the right idea. 

The payments industry has always been committed to fraud. It 
is part of what we do. And I am not here to defend fraudulent ac- 
tors. 

Consumers in the United States choose electronic payments over 
cash and checks because they have zero liability for fraud. And the 
cost of that fraud is generally borne by ETA members. So ETA 
members commit massive amounts of resources in time and money 
into detecting and eliminating fraud. 

Every participant in the payment system has developed effective 
due diligence programs to both prevent fraudulent actors from ac- 
cessing the payment system and to terminate access from fraud is 
determined. For example, last year, 5 percent of merchant applica- 
tions were denied and ETA members terminated more than 10,000 
fraudulent merchants. 

As you know, fraud never stops. It never sleeps. And so the in- 
dustry can — must continuously develop new techniques to fight it. 
With the expansion and ubiquitousness of the Internet, that cre- 
ates new challenges. As we build a 10-foot wall, the crooks build 
an 11-foot ladder. 

So, in response, ETA developed new guidelines that we have put 
out for the entire industry, not just ETA members, that represent 
100 pages of due diligence designed to increase the underwriting 
methods and enhance the ability of the industry in this new day 
and age to detect and eliminate fraud. 

These guidelines are drawn based on existing rules that exist 
both at individual companies and across the payments ecosystem, 
and they also draw from Operation Choke Point. It is part of the 
regulatory environment that we operate in. And so we have in- 
cluded many references and similar concepts in the guidelines. 

Our concerns with Operation Choke Point are that it neglects the 
payments industry’s efforts in this area to detect and eliminate 
fraud. It creates a confrontational approach that has a chilling ef- 
fect on the payments industry’s ability and willingness to report 
fraudulent merchants to law enforcement mainly because the pay- 
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ments industry believes that they may be subject to enforcement 
action if they do report. 

And this harms three categories of merchants. One, we have seen 
evidence of companies dropping whole classes of merchants. We see 
increased costs for merchants, not just those in high-risk cat- 
egories, but across the system. And we see — we could see a restric- 
tion of access to the payment system in the future for new mer- 
chants trying to gain it. 

What our main particular focus is with Choke Point, what our 
main concern is, is that regulators and law enforcement agencies 
seem to be changing the long-standing policy of only focusing on 
those payment companies who have actively engaged in fraud. 

It appears that OCP is — Operation Choke Point is trying to hold 
law-abiding payment companies liable for something as simple as 
a high return rate or simply providing merchants access to the pay- 
ment system. If this is the case — and this is our fear, that the con- 
sequences I just mentioned will come to bear. 

The Operation Choke Point is not just limited to — as everyone 
knows, to Department of Justice. Other regulators and law enforce- 
ment agencies appear to be getting into the game or adopting simi- 
lar approaches. For example, ETA members have received commu- 
nications from the FTC with Operation Choke Point-like questions 
involved. 

We believe there are more targeted and more efficient ways to 
detect and eliminate fraud. The payments industry makes a better 
partner than a target in this effort. A cooperative approach, like 
combining self-regulatory efforts, like the ETA’s guideline, are 
more likely to strike the right balance than the blunt law enforce- 
ment action contained in Operation Choke Point. 

Another idea is to create a reasonable safe harbor that would 
allow law-abiding payment companies to report fraudulent mer- 
chants to law enforcement without fear of triggering an enforce- 
ment action. 

ETA stands ready to work with regulators and law enforcement 
toward our common goal of detecting and eliminating fraud. 

Thank you again for the opportunity to testify before the Sub- 
committee, and I welcome any questions you may have. 

[The prepared statement of Mr. Talbott follows:] 
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Chairman Bachus, Ranking Member Johnson and Members of the Subcommittee, the Electronic 
Transactions Association (ETA) appreciates the opportunity to submit this statement for the 
record for the House Judiciary Committee’s Subcommittee on Regulatory Reform, Commercial 
and Antitrust Law’s hearing, “Guilty until Proven Innocent? A Study of the Propriety & Legal 
Authority for the Justice Department’s Operation Choke Point." 

ETA is an international trade association representing companies that offer electronic transaction 
processing products and services related to debt, credit, and prepaid cards. The purpose of ETA 
is to grow the payments industry by providing leadership through education, advocacy, and the 
exchange of information. ETA’s membership spans the breadth of the payments industry, from 
financial institutions to transaction processors to independent sales organizations to equipment 
suppliers. More than 500 companies worldwide are members of ETA. 

Keeping Fraud Off Payment Systems 

ETA strongly supports the vigorous enforcement of existing laws and regulations to prevent 
fraud. Consumers in the United States choose electronic payments over cash and checks because 
they have zero liability for fraud, making electronic payments the safest and most reliable way to 
pay. As a result, payment companies are generally responsible for paying for fraud involving 
payment systems under Federal law and payment network rules, and thus our members have a 
strong interest in making sure fraudulent actors do not gain access to payment systems. With the 
benefit of decades of payment system expertise, ETA members have developed effective due 
diligence programs to prevent fraudulent actors from accessing payment systems and to 
terminate access for network participants that engage in fraud. These programs have helped to 
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keep the rate of fraud on payment systems at remarkably low levels. In 2012, there was more 
than $4.6 trillion in debit, credit and prepaid card transactions in the United States, but there was 
only $5.5 billion in credit card fraud. In addition, a recent survey of ETA members indicates that 
more than 10,000 merchants were discharged last year for fraud. These actions demonstrate the 
commitment of ETA members to keeping fraudulent actors off payment systems. 

Despite this strong record, however, payment processors can never take the place of regulators 
and law enforcement in protecting consumers. Because regulators and law enforcement can 
issue subpoenas, conduct investigations, and have far great resources, personnel, and legal 
authorities, they will always be in a far better position to combat fraud. Yet, payments 
companies are committed to doing their part. 

ETA therefore believes we must be constantly vigilant on continuing to update our processes. 
The growth of internet commerce has created remarkable new opportunities for business and 
benefits for consumers, but unfortunately also has created new opportunities for fraud. For 
example, because websites can change in the blink of an eye, they can be difficult to monitor and 
easy for fraudsters to exploit. Hence, ETA welcomes further Federal efforts to combat 
fraudulent activity by unscrupulous merchants that operate on the internet. 

In an effort to further strengthen payment systems, ETA has recently published new industry 
guidelines for merchant due diligence and monitoring that provide more than 100 pages of 
methods and practices to detect and halt fraudulent actors. The ETA Guidelines were developed 
by ETA‘s member companies after months of discussions and sharing of techniques to prevent 
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fraud. During this process, ETA even shared the preliminary draft guidelines with, and sought 
comments from, the Federal Trade Commission (FTC), which had strongly encouraged the 
industry to strengthen its anti-fraud efforts. Now', ETA is actively encouraging its members and 
companies across the payments ecosystem to make use of the guidelines, especially smaller 
companies that may not have the resources to develop such advanced practices on their own. 

The ETA Guidelines provide a practical and targeted approach to combating fraud on payment 
systems. ETA members already have a strong commitment to, and financial interest in, keeping 
fraudulent actors off payment systems, but the targeted nature of the ETA Guidelines gives them 
enhanced tools to improve their effectiveness and help ensure that law-abiding merchants do not 
unfairly lose access to payment systems due to overly broad anti-fraud protections. 

Another benefit of the ETA Guidelines is that they provide a basis for payments companies to 
work cooperatively with Federal regulators and law enforcement toward their common goal of 
stopping fraud. ETA strongly believes that such a collaborative approach is good public policy 
It would encourage companies to cooperate with law enforcement by fostering an environment 
of open communications between government agencies and payments companies. As a result, 
such a cooperative approach would be more effective at protecting consumers from fraud. 

Concerns About Operation Choke Point 

Unfortunately, the Department of Justice (DOJ) and other Federal regulators have begun 
pursuing a more confrontational approach to addressing fraud on payment systems. On March 
20, 2013, the Financial Fraud Enforcement Taskforce publicly announced a new initiative by its 
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Consumer Protection Working Group (which is co-chaired by representatives from the DOJ, the 
FTC, and the Consumer Financial Protection Bureau) to address mass consumer frauds by 
holding banks and payment processors liable for the acts of certain merchants. 1 This initiative, 
named “Operation Choke Point" by the DOJ, aims to “close the access to the banking system that 
mass marketing fraudsters enjoy - effectively putting a chokehold on it." 2 3 

Although ETA strongly supports increased law enforcement aimed at preventing mass frauds, it 
has serious concerns about the Operation Choke Point approach. In ETA’s view. Operation 
Choke Point employs the wrong legal tools, is unnecessarily confrontational, and creates serious 
risks to law abiding processors and merchants without producing any benefits to consumers 
beyond those which could be obtained with a more focused and collaborative approach. 

The DOJ has sought to implement Operation Choke Point by initiating investigations and civil 
suits under the Financial Institutions Reform, Recovery, and Enforcement Act, 12 U.S.C. § 
1833a (FIRREA). Under F1RREA, the DOJ can initiative investigations and bring civil suits for 
alleged violations of 14 predicate criminal offenses, including wire fraud “affecting a federally- 
insured financial institution.” 1 Several courts have recently held that FIRREA suits can be 
brought against not only third parties whose violations “[affect] a federally-insured financial 
institution,” but also against the banks whose violations affect themselves. 4 This broad reading 
of FIRREA has given DOJ a very powerful tool because under FIRREA the statute of limitations 


1 Iitm://w\TO.iustice.uov7im/oDi^dot/sDeeehes/2013/oDa -SDeecf i- 130320.1i tnii. 

7 ~Id - " 

3 12 U.S.C. § 1833a(c)(2). 

3 United States v. Bank of New York Mellon . 941 F. Supp. 2d 438 (S.D.N.Y. 2013); United States v. Countrywide 
Fin. Corn. . 961 F. Supp. 2d 598 (S.D.N.Y. 2013); United States v. Wells Faruo Bank, N.A. . 972 F. Supp. 2d 593 

(S.D.N.Y. 2013). 
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is 10 years and cases only need to be proven by “preponderance of the evidence,” rather than the 
“beyond a reasonable doubt” standard required in criminal prosecution. 3 * In addition. FTRREA 
provides for penalties of up to $5 million for each violation or, if greater, the amount of any 
pecuniary gain derived by the violation or of any losses inflicted on another person. 6 These 
provisions significantly tilt the litigation playing field in favor of the DOJ and make FIRREA 
cases very costly for companies to defend against and risky to litigate. 

It is important to note that FIRREA was not designed to address mass frauds. It was passed to 
refonn the regulatory regime for thrifts in the wake of the S&L Crisis of the 1 980s. The purpose 
of Section 1833a was to protect the government from financial frauds. Flence, Section 1833a 
provides the Federal government with enhanced authority to pursue claims against individuals 
for fraudulent actions that directly harm the Federal government or harm financial institutions 
insured by the Federal government. It is not a consumer protection statute, which is 
demonstrated by the fact that FIRREA penalties do not redress consumer injury, but instead get 
paid to the U.S. Treasury. Therefore, the use of FIRREA for consumer protection purposes is a 
case of the wrong tool being used for the right goal. 

Although no court has yet issued a final decision in a FIRREA case involving payment 
processing, DOJ has recently settled two FIRREA cases involving payment processing and 
issued scores of subpoenas to financial institutions as part of Operation Choke Point. These 
settlements, combined with recently released DOJ memoranda detailing the agency's plans for 
Operation Choke Point, have raised concerns among ETA’s members that Operation Choke Point 

3 12U.S.C. § 1833a(f). (h). 

6 12 U.S. C. § 1833a(b). 
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will result in the government seeking to broaden the scope of processor liability for the acts of 
merchants. 7 There is also concern that Operation Choke Point will be used to impose penalties on 
financial institutions for processing transactions of certain categories of legal but disfavored 
businesses. 

The problems with Operation Choke Point are not limited to the DOJ. ETA is also concerned 
that other Federal regulators are considering following the DOJ's lead and adopting additional 
initiatives modeled on Operation Choke Point. ETA’s members have reported a sharp increase in 
information requests and civil investigative demands from the FTC. In light of the DOFs 
implementation of Operation Choke Point and recently released DOJ memorandum indicating 
FTC involvement with the development of Operation Choke Point, the FTC’s increased interest 
in payment processing has sparked concerns that the FTC has begun its own Operation Choke 
Point. 8 

Currently, the FTC can assert jurisdiction over payment processors that engage in unfair or 
deceptive acts or practices in violation of Section 5 of the Federal Trade Commission Act, and 
violations of the Telemarketing Sales Rule. 9 The FTC also can bring cases against payment 
processors for “assisting and facilitating” a merchant’s violations of the Telemarketing Sales 


' The Department of Justice's "Operation Choke Point": Illegally Choking Off Legitimate Businesses? . U.S. House 
of Representatives, Committee on Oversight and Government Reform, Staff Report (May 29, 2014), Appendix I . 

8 Id. (The DOJ has indicated that it is making “significant efforts to engage other agencies,” including the FTC. 
The DOJ also has noted that **[t]he FTC's efforts in this area predate our own, and not surprisingly our agencies 
work closely together.” (Memorandum dated November 21, 2013 to Staff of the Office of the Attorney General cl. 
al. fromMaame Evvusi-Mensah Frimpong, Deputy Assistant Attorney General, Civil Division. Subject: Operation 
Choke Point, p. 12)). 

9 15 U.S.C. § 45; 16 C.F.R. § 310. 
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Rule, but such liability only applies if a payment processor “knows or consciously avoids 
knowing” that the merchant violated the rule. 1 

ETA fully supports the proper enforcement of these statutes by the FTC, but is concerned that 
the FTC is looking to change its long-standing policy of pursuing only processors that were 
actively engaged in assisting a merchant in committing fraud or avoiding detection. To the 
extent the FTC begins premising liability on nothing more than providing a merchant an account, 
or deems high return rates to be constructive knowledge of fraud, it will be dramatically altering 
the liability scheme for payment processing in a manner that could have significant, adverse 
consequences. 

Impact of Operation Choke Point on Processors, Entrepreneurs, and Consumers 

From a public policy perspective. Operation Choke Point and any similar efforts by the FTC or 
other regulators to impose enhanced liability on payment processing will likely have adverse 
consequences for not only merchants and entrepreneurs, but also the very consumers Operation 
Choke Point purports to protect. In addition. Operation Choke Point sets a troubling precedent 
of government agencies using the payment systems to achieve objectives unrelated to preventing 
financial fraud. 

First, if payment companies 1 liability for the actions for merchants increases, processors may 
very well have little choice but to increase the prices of payment services for merchants and/or 
restrict access to their payment systems to manage their new liability exposure. Invariably, the 


10 


16C.F.R. § 310.3 
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brunt of these burdens will fall on small, new and innovative businesses because they pose the 
highest potential risks. For example, start-up internet businesses with liberal return policies 
present high risks to financial institutions because they have no transaction history, rely on card- 
not-present transactions and have (by design) high return rates. Federal regulators view high 
return rates as strong evidence of fraud. Due to the risks these new businesses present, banks 
and payment processors may very well decide that the increased liability risks outweigh the 
benefits of having them as customers. Because in today's marketplace consumers expect 
merchants to accept debit, credit, and prepaid cards, the inability of a merchant to access the 
payment systems could effectively be the death knell for its business. New restrictions on access 
to payment systems, or even higher costs to access payment systems, could therefore become an 
impediment to job creation and innovation, especially in the critical high-tech start-ups and 
internet commerce segments of the economy. 

Second, increasing liability on payment processing, especially processing of debit, credit, and 
prepaid cards, does not necessarily benefit consumers. It is consumers who will ultimately pay 
for the higher costs arising from increased liability. They also will be harmed by the 
inconvenience of not being able to use their preferred methods of payment (credit, debit, and 
prepaid cards) with some merchants due to more restrictive access to payment systems. 
Similarly, they would be harmed if new liability on processors impedes continued innovations in 
electronic payments. Over the last twenty years, electronic transactions have grown rapidly to 
become the dominant method of payment for consumer transactions due to their convenience, 
security (especially when compared to cash), and customer service. Therefore, to the extent that 
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new liability risks impede the evolution of electronic transactions, consumers will have less 
access to the payment methods they prefer and beneficial developments in electronic payments. 

Third, there is a real risk that a confrontational approach, like Operation Choke Point, will alter 
payments companies’ natural incentive to cooperative with law enforcement and regulatory 
authorities if they believe that such cooperation will only result in enforcement actions against 
them. Thus, a far better approach would be to establish a reasonable safe harbor that would 
allow payments companies, which were not directly involved in the fraudulent activities of a 
merchant, to work with regulators without any risk of triggering an enforcement action. ETA 
believes that such cooperation between payments companies and regulators is likely to be more 
effective because it recognizes and further strengthens the strong incentives such companies 
already have to prevent fraudulent actors from accessing payment systems. This conclusion (as 
well as further analysis of the adverse consequences arising from imposing additional liability on 
payment processors) was also the result of a recent study by NERA Economic Consulting 
commissioned by ETA, which is attached as Exh ibit A . 

Finally, enforcement actions against payment systems are an inappropriate tool for regulators to 
use to limit the ability of consumers to access legal but currently disfavored industries. There 
has been much debate about the attempts by Operation Choke Point and similar regulatory 
efforts to compel payments companies to sever relationships with a variety of legal but 
disfavored industries, ranging from coin dealers and short-term lenders, to home-based charities 
and pharmaceutical sales." ETA believes that such efforts unfairly expose institutions to 

11 See The Department of Justice’s “Operation Choke Point”: Illegally Choking Off Legitimate Businesses? . U.S. 
House of Representatives, Committee on Oversight and Government Reform, Staff Report (May 29, 2014). p. 8. 
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regulatory actions merely for engaging in lawful commerce. Moreover, if the precedent is set 
that regulators can unilaterally intervene to keep certain lawful industries off payment systems, 
payments companies will be subject to shifting regulatory exposure as the disfavored industries 
of regulators shifts with changes in administrations and agency personnel. If regulators have 
concerns about a particular industry, the appropriate forums for addressing those concerns are 
formal rulemakings, Congress, or state legislatures. To be clear, ET A takes no position on which 
types of industries should be legal and its members are fully committed to preventing any 
businesses engaged in activities prohibited by statute or regulation from accessing payment 
systems. ETA merely seeks to ensure that payments companies can freely process transactions 
for any law-abiding merchant. 

Conclusion 

Operation Choke Point is premised on the flawed assumption that increasing liability on lawful 
payments companies for the actions of fraudulent merchants will yield only benefits to 
consumers. In practice, however, imposing new liability standards on such institutions is likely 
to have serious adverse consequences for not only law-abiding merchants, but also consumers 
generally. There needs to be a careful balancing of the need to limit access to payment systems 
to prevent fraud and the need to ensure that all law-abiding businesses can access the payment 
systems consumers want to use. A cooperative approach to combating fraud by financial 
institutions and Federal regulators is far more likely to strike the right balance than blunt 
enforcement actions. Accordingly, ETA stands ready to work with federal regulators to work 
cooperatively toward our common goal of preventing fraud. 
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Mr. Bachus. Mr. Thompson. 

TESTIMONY OF DAVID H. THOMPSON, 

MANAGING PARTNER, COOPER & KIRK, PLLC 

Mr. Thompson. Mr. Chairman, Ranking Member Johnson, and 
Members of the Subcommittee, thank you very much for including 
me on this panel today. 

The Department of Justice, working with the FDIC, the OCC, 
and the Fed have conspired to choke off and strangle legitimate 
businesses by depriving them of access to the financial system. 
Many of the victims of Operation Choke Point are legitimate busi- 
nesses. 

These agencies have undertaken this operation without any Con- 
gressional authorization and, although they may disapprove of 
these industries, neither the FDIC nor the OCC nor the Fed have 
any power to shut down lawful businesses. They can ensure the 
safety and soundness of banks, but they have no authority to con- 
demn wholesale lawful industries. 

To make matters worse, the Department of Justice and the bank- 
ing agencies have failed to provide these law-abiding companies 
with any opportunity to be heard and to defend themselves. In- 
stead, they have acted through back-room — a back-room campaign 
of veiled threats and regulatory intimidation. 

I come to you today on behalf of the Community Financial Serv- 
ices Association of America, the leading trade association for short- 
term credit providers, and its members have been targets of Oper- 
ation Choke Point. 

It is important to understand the mechanism by which these 
agencies have brought about their desired result. The banking 
agencies have targeted disfavored industries by expanding the defi- 
nition of reputational risk. This is the club that they yield and 
wield. 

The agencies had previously and consistently defined the concept 
of reputational risk to refer specifically to the risk of a bank’s rep- 
utation that arose from its own services and its own products. A 
bank’s reputation could suffer, in other words, if it provided sub- 
standard products or services. 

But the agencies had never before held — said that a bank needed 
to assess the reputation of its customers as part of its manage- 
ment. Banks ensured their good reputation by meeting the needs 
of their customers, not by judging the popularity of their cus- 
tomers. 

This is, of course, not to say that a bank had no need to evaluate 
its customers. A bank is required to have procedures in place that 
ensure that it does not engage in illegal activity or facilitate the 
commission of crimes by its customers. This risk is encompassed 
under the rubric of compliance risk, however, not that of reputation 
risk. 

A bank was never required before to have procedures in place to 
ensure that it did not have customers who, though lawfully en- 
gaged in demonstrably lawful businesses, might simply be unpopu- 
lar with the public or with the current Administration. 

In imposing this new interpretation of reputation risk upon the 
banking industry, the agencies have consistently chosen to proceed 
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without providing the public with notice and an opportunity to 
comment, and this is a fatal flaw in this regulatory regime. 

It violates the Administrative Procedures Act. It violates the due 
process clause. And these violations have real-world consequences. 
Members of the association I represent have had scores of banking 
relationships severed in the aftermath of Operation Choke Point. 

And the key point to understand is that these relationships have 
been long-standing. They have harmoniously coexisted with safety 
and soundness requirements and anti-money laundering regimes. 
And now over 80 banks have severed these relationships. Light- 
ening might strike in the same place twice on occasion, but it 
doesn’t strike 80 times over and over and over again by coinci- 
dence. 

And something has changed. It is not the return rates of the 
short-term lending industry. It is not their return — their risk pro- 
file. There is nothing in the free market that has changed. It is Op- 
eration Choke Point that has changed. That is the driving force be- 
hind these decisions. 

Thank you, Mr. Chairman. 

[The prepared statement of Mr. Thompson follows:] 
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Chairman Bachus, Ranking Member Johnson, and Members of the Subcommittee. Good 
morning, and thank you for inviting me to participate in today’s hearing on “Guilty until Proven 
Innocent? A Study of the Propriety & Legal Authority for the Justice Department’s Operation 
Choke Point.” I am honored to be included among the distinguished members of this panel, and I 
am pleased to be able to share with you today my thoughts on the deeply-troubling legal issues 
that are raised by the Department of Justice’s (“DOJ”) Operation Choke Point. 

DOJ is now using against legitimate American businesses tactics that are strikingly 
similar to those that have been used against corrupt foreign institutions serving terrorists. 
Working with DOJ, the Federal Deposit Insurance Corporation (“FDIC”). the Office of the 
Comptroller of the Currency (“OCC”), and the Board of Governors of the Federal Reserve 
System (“the Board”) have conspired to choke off and strangle legitimate businesses by 
depriving them of their access to the financial system. Many of the victims of Operation Choke 
Point are law-abiding companies, ranging from coin dealers to dating services. With their ability 
to open a bank account or even to deposit a check now taken from them, these law-abiding 
companies are being deprived of their right to pursue their chosen trade and of their very right to 
exist. 

DOJ has undertaken this operation without any Congressional authorization. Although 
they may disapprove of these businesses, neither FDIC, nor OCC, nor the Board has the power to 
shut the industry down, or even significantly restrict it, through ordinary, legal means. The 
statutes under which these three agencies perform their regulatory duties authorize them to 
ensure the safety and soundness of the banks. While these agencies have the authority to police 
the banking system, they have no authority to judge and condemn whole industries as unworthy 
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of access to that banking system. It is neither surprising nor unreasonable that Congress has not 
delegated such sweeping power. 

To make matters worse, DOJ and the banking agencies have failed to provide these law- 
abiding companies, including short-term credit providers, with any opportunity to be heard and 
to defend themselves against these scurrilous accusations and slanders. The agencies have 
chosen to proceed not through notice and comment rulemaking nor through any procedure that 
would expose their operation to the oversight of the Congress; they have acted instead through a 
back room campaign of veiled threats and regulatory intimidation. They have made no effort to 
distinguish those who are breaking the law from those who are making every effort to comply 
with not only the letter but also the spirit of our consumer protection laws. In sum. Operation 
Choke Point is unconstitutional, unlawful, and simply un-American. 

1. The Short-Term Credit Industry Meets the Needs of America’s Underserved 

Communities. 

I come before you today to speak on behalf of the Community Financial Services 
Association of America (CFSA), the leading trade association representing short-term credit 
providers. The Association and its members provide short tenn loans that help consumers, many 
of whom are underserved, make ends meet in today's difficult economic conditions. These loans 
are typically the equivalent of an advance on the borrower’s paycheck or other source of regular 
income. They provide a type of short-term credit to over nineteen million American households, 
helping to bridge the unexpected financial needs that often arise between income installments. 

A short-term, small dollar loan is a convenient and reasonably-priced vehicle for short- 
term financial needs, often cheaper than overdraft fees and late fees on credit cards or utility 
bills. Many short-term credit providers offer other financial services to their customers, 
including bill payment, check cashing, installment loans, and prepaid debit cards. Like short- 
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term small dollar loans, these lines of business serve critical needs in underserved communities. 
Members of these communities often cannot obtain any service from a bank or can obtain those 
services only at costs far higher than would be charged by a short-term credit provider. 
Furthermore, customers want these products, as they believe they are cost competitive and 
effective and are satisfied with their experiences with short term credit providers. According to a 
Harris poll of CFSA members’ customers conducted in 2013, well over 90 percent expressed 
satisfaction with the terms (96%) and cost (92%) of their short-term small-dollar loans, had 
found that those loans provided a valuable safety net during times of unexpected financial 
difficulty (95%), and believed that they should be free to take out such a loan without 
government interference (95%). 

Both the Congress and the State legislatures have recognized the importance of short- 
term small-dollar loans and the potential consequences of their misuse. As a result, most 
States — oftentimes acting in consultation with and with the cooperation of the trade associations 
that represent the short-term credit industry- have passed robust consumer protection laws to 
ensure that loans are offered and consumed responsibly. These laws require licensing to 
specifically authorize these lenders to operate in their state, may cap the amount of the loan or its 
fees, limit the number of times a consumer may renew a loan, and/or require certain disclosures. 
Every member of the CFSA must hold a license and comply with the laws in every state in which 
they maintain a storefront location and in every state in which their online customers reside. The 
federal consumer financial protection laws also apply to these lenders, including TILA, ECO A, 
EFTA, FCRA, and UDAAP. Notably, the Truth in Lending Act, 15U.S.C. § 1601 et seq., 
requires full disclosure of the costs and terms of the loans in order to ensure that consumers have 
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the information they need to make responsible borrowing decisions. Short-term credit providers 
are frequently examined by state regulators and by the CFPB. 

Short-term credit providers of necessity rely on banking services to operate. When a 
prospective borrower applies for the loan — at a storefront location, or online — he or she typically 
provides a post-dated check or an electronic debit authorization for the value of the loan, plus a 
fee. The lender immediately advances the customer funds, then after a specified period of time, 
usually determined by the customer’s next payday, the borrower returns to repay the loan and 
fee. But if the customer does not return, the terms of the transaction permit the lender to deposit 
the post-dated check or to execute the debit authorization. In order to have that security, the 
lender must have a deposit account with a bank and/or access to the Automated Clearing House 
(ACH) network. 

It is their reliance on the banks for conducting their businesses that made short-term 
credit providers an easy first target for DOJ’s campaign against lawful businesses who are 
disfavored by the current administration. Lacking the legal authority to regulate short-term 
credit providers, FDIC, OCC, and the Board have, in coordination with DOJ, conducted a 
campaign of extra-legal regulation, first imposing an expanded standard of reputation risk on the 
industry and then using that standard to threaten banks who do business with short-term credit 
providers. It is about the legal and, specifically constitutional, concerns that are raised by this 
campaign of de facto regulation and administrative intimidation that I would like to speak with 
you today. 
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II. The Ever-Expanding Regulatory Definition of “Reputation Risk.” 

The agencies have the authority under the Federal Deposit Insurance Act to ensure the 
safety and soundness of the banking industry. See 12 U.S.C. § 183 lp-1 . In performing their 
statutory duty, the agencies have required that the banks have adequate procedures in place to 
assess and manage risk. 1 Among the specific risks that a bank must manage is the risk that its 
reputation may become tarnished in the eyes of the public. 

The agencies had previously and consistently defined the concept of "reputation risk” to 
refer specifically to those risks to a bank’s reputation that arose from the products and services 
provided by the bank itself and by third parties with whom a bank contracted for the provision of 
those products and services. A bank’s reputation could suffer, in other words, if it provided or 
seemed to provide poor products and poor service to its customers. 

The agencies had never before held that a bank needed to assess the reputation of its 
customers as part of its management of reputation risk. Banks insured their good reputation by 
meeting the needs of their customers, not by judging the popularity of their customers. 

This is, of course, not to say that a bank had no need to evaluate its customers. A bank is 
required to have procedures in place that ensure that it does not engage in illegal activity or 
facilitate the commission of crimes by its customers; this risk is encompassed under the rubric of 
compliance risk, however, not that of reputation risk. A bank was never before required to have 
procedures in place to ensure that it did not have customers who, though lawfully engaged in 


1 The agencies have identified several such risks that a depository institution must manage. 
These include credit risk, market risk, liquidity risk, operational risk, and compliance risk. See, 
e g., FRB, Supervisory Letter: Risk-focused Safety and Soundness Examinations and 
Inspections. SR 96-14 (May 24, 1996). 
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demonstrably lawful business pursuits, might simply be unpopular with the public or with the 
current administration. 

Although DOJ is now using FD1C, OCC, and the Board to wage its covert campaign 
against disfavored industries and businesses, these three agencies had already for some time been 
expanding their regulatory power through a gradual process of interpretive redefinition of the 
concept of reputation risk. They carried out this process of incremental self-aggrandizement by 
progressively unmooring the concept of reputation risk from its traditional definition within the 
banking industry. 

For example, in the summer of 201 1, FDIC published a Supervisory Insight article 
entitled “Managing Risks in Third-Party Payment Processor Relationships.” The article warns 
banks of heightened risks, including reputation risks, associated with doing business with certain 
types of merchants, including online payday lenders. FDIC, Managing Risks in Third-Party 
Payment Processor Relationships, SUPF.RVSIORY INSIGHTS, Summer 201 1 , at 3, For the first 
time, the article offers a list of 30 merchant categories, including online payday lending and 
numerous other lawful businesses that the agency has deemed to involve “hi gh-risk” activity. 

The Department of Justice has acknowledged, in response to legislative investigations of 
Operation Choke Point, that FDIC developed this list of “high-risk merchants” for purposes 
related to regulating the banking industry. Letter from Peter J . Kadzik, Assistant Attorney 
General, U.S. Department of Justice, Office of Legislative Affairs, to the Honorable Tim 
Johnson, Chairman, Committee on Banking, Housing, and Urban Affairs, U.S. Senate, 4 (June 
24, 2014). The article further urges banks to be wary of customers with high aggregate return 
rates and those that bank with more than one financial institution. Id. 
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In imposing this new interpretation of reputation risk upon the banking industry, the 
agencies have consistently chosen to proceed without providing the public with notice and an 
opportunity to comment. Furthermore, these agencies provide no objective criteria for 
measuring reputation risk or for distinguishing between law-abiding, responsible bank customers 
and bank customers that engage in fraudulent or otherwise unlawful financial practices. Far 
from tailored guidance that would aid banks in targeting those customers who are engaged in 
fraudulent or otherwise unlawful practices, the agencies have created a vague and subjective 
standard that can be used to pressure banks to cut off relations with law-abiding customers 
engaged in any line of business that is disfavored by DOJ. 

The opportunity for abuse that is inherent in such a subjective and pliant standard is 
patent. Under the guise of protecting the safety and soundness of banks, FDIC, OCC, and the 
Board are now using this newly defined concept of reputation risk to wage a covert war against 
certain legitimate businesses that rely on banking services to function and that are disfavored by 
this administration, including short-term credit providers. 

III. The Agencies Are Imposing Regulations on the Banking Industry Without Statutory 
Authority and Without Observing the Procedural Requirements of the 
Administrative Procedure Act. 

In order to play their part in Operation Choke Point, the agencies are relying extensively 
on their redefinition of reputation risk, a concept now transformed into one that requires a bank 
to assess the reputations of each and every one of its customers and to refuse to do business with 
those customers whom, in the judgment of the regulators, the public might disfavor. The 
implementation of this new standard has been carried out without statutory authorization and 
without observing the procedures required by the Administrative Procedure Act. 
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The Administrative Procedure Act requires that agency actions be set aside when they are 
conducted "without observance of procedure required by law.” 5 U.S.C. § 706(2)(D). Before it 
may promulgate a binding rule or substantially revise a previously announced interpretation, an 
agency must provide public notice in accordance with law and "‘give interested persons an 
opportunity to participate in the rule making through submission of written data, views, or 
arguments with or without opportunity for oral presentation.” 5 U.S.C. § 553(b), (c). 

The agencies failed to provide any sort of notice and opportunity to comment in advance 
of promulgating the rules relating to their new definition of reputational risk. These documents 
do more than merely announce “interpretative rules and statements of policy”; they have been 
and are being enforced by the banking agencies to create new legal obligations for banks wishing 
to do business with the entities described in guidance documents, including short-term credit 
providers. 

Reputation risk — the fulcrum for Operation Choke Point — is no longer limited to the risk 
that negative publicity regarding a financial institution itself or third parties who provide services 
in its name will cause a decline in customer base, costly litigation, or loss of revenue. Reputation 
risk has now been redefined and remade into a concept that is vague, manipulable, and wholly 
foreign to customary bank examination practices. 

As redefined, reputation risk could “ostensibly be invoked to compel a depository 
institution to sever a customer relationship with a small business operating in accordance with all 
applicable laws and regulations but whose industry is deemed ‘reputationally risky’ for no other 
reason than that it has been the subject of unflattering press coverage, or that certain Executive 
Branch agencies disapprove of its business model.” Letter from Rep. Jeb Hensarling, Chairman, 
H. Comm, on Fin. Servs., to Janet Yellen, Chair, The Fed. Reserve Sys. (May 22, 2014). “The 
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introduction of subjective criteria like ‘reputation risk’ into prudential bank supervision can all 
too easily become a pretext for the advancement of political objectives, which can potentially 
subvert both safety and soundness and the rule of law ” Id. 

The requirements of the Administrative Procedure Act are not mere technicalities. 

Notice and comment rulemaking ensures that an agency will consider the ramifications of what it 
is doing, address the concerns of the regulated industry and of other interested parties impacted 
by the regulation, and adequately explain its statutory authority and its expert rationale. 

Notice and comment rulemaking was devised by Congress in order to make sure that an 
agency does not adopt irrational, arbitrary, and capricious rules. The failure to make use of this 
statutorily-required procedure has here resulted in a rule that is vague, malleable, standardless, 
and open to misunderstanding, misapplication, and simple abuse. In promulgating their new 
definition of reputation risk, the Agencies’ have created precisely the sort of defective rule that 
notice and comment rulemaking was designed to prevent. 

Of perhaps even greater concern, this novel definition of reputation risk has untethered 
the agencies from their statutory source of authority, making them no longer prudential 
regulators of American financial institutions, but the legal and reputational police of American 
society. As documents uncovered in recent investigations of Operation Choke Point confirm, 
short-term credit providers are only the first in a long series of businesses which the government 
now intends to target for extermination on the ground that they are “reputationally risky” in the 
eyes of the FD1C, OCC, the Board, and DOJ. 
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IV. The Agencies Have Deprived Americans of Their Liberty Without the Due Process 
of Law Required by the fifth Amendment to the Constitution. 

The Fifth Amendment to the Constitution guarantees that no person will be deprived of 

life, liberty, or property without due process of law. In their effort to advance their agenda, 

FD1C, OCC, and the Board have each violated this basic tenet of constitutional jurisprudence. 

Short-term credit providers have been the first industry to be stigmatized, branded, barred from 

pursuing their chosen line of business, and deprived of their banking relationships without any 

notice or opportunity to be heard and to defend their right to exist. 

As an initial matter, the agencies have inflicted grave reputational harm upon CFSA’s 

members and other law-abiding responsible short-term credit providers by stigmatizing them as 

“illegitimate,” “fraudulent,” and “high risk.” They gave no notice to the industry of their 

judgment. They gave the industry no opportunity to be heard. They simply announced to the 

banks which they regulate that they had decided that short-term credit providers are “fraudulent.” 

Under Operation Choke Point, sentence is now being passed and carried not only without due 

process of law but without regard for the guilt or innocence of the accused. 

This stigma that the banking agencies have branded upon the law-abiding and responsible 

short-term credit providers now threatens to preclude them from pursuing their chosen line of 

business. Indeed, to choke off these businesses from the financial services that they must have in 

order to pursue their chosen line of business is the precise purpose of the agencies’ actions, a 

purpose openly declared in the very name that the government has chosen for its unlawful 

enterprise: Operation Choke Point. America’s short-term credit providers have been deprived of 

their right to continue to exist without having been provided any notice or having been afforded 

any opportunity to be heard. 
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Further, by attacking the reputations of short-term credit providers, the agencies have 
effectively coerced financial institutions to cease providing them with bank accounts and other 
essential financial services. The agencies have thus deprived these lenders of tangible benefits 
and interests that they had previously possessed. Again, they have done so without providing the 
process due under the law. 

The behavior of these agencies and of DOJ in their conducting of Operation Choke Point 
has fallen well short of the requirements of the law of our land. Put simply. Operation Choke 
Point is patently, flagrantly, and intolerably un-American. This is not how law is made and 
enforced in America. This is not how justice is served in our society. 

V. The Casualties of Operation Choke Point 

DOJ and the three banking agencies may claim that the aim of Operation Choke Point is 
to choke off only “fraudsters” and unlawful businesses, but the actual results of Operation Choke 
Point prove otherwise. The vague and malleable standard of reputation risk has provided banks 
with no guidance on how to discriminate between lawful and unlawful enterprises. Faced with 
the thinly-veiled threats of the banking regulators and the tactics of intimidation and 
prosecutorial bullying, the banks have had no choice but to yield to the coercion of their 
regulators and terminate those customers who failed to curry the favor of the administration. 

This concerted campaign has had the result, therefore, of sweeping away the members of the 
short-term credit industry without regard for guilt or innocence. 

As a growing number of banks have terminated their relationships with law-abiding, 
licensed, and responsible short-term credit providers, these businesses must each day wonder 
when the government will terminate their remaining banking relationships and must compete for 
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service within the ever shrinking pool of banks who remain committed to their mission of 
providing customer service and are willing to stand up to regulatory bullying. 

1 will offer a few examples of the damage that Operation Choke Point has already done to 
the short-term credit industry. One lender. Advance America, has lost longstanding and positive 
business relationships with at least nine banks as a result of Operation Choke Point. Hancock 
Bank and Whitney Bank informed Advance America of their intention to close its accounts on 
the ground that they were “unable to effectively manage [the lenders’] Account(s) on a level 
consistent with the heightened scrutiny required by [their] regulators . . . Fifth Third Bank 
wrote that it would stop doing business with short-term credit providers altogether on the ground 
that the entire industry is “outside of [its] risk tolerance.” Synovus Bank and Umpqua Bank 
likewise terminated Advance America’s accounts. At least two of Advance America’s banks 
expressed regret and explained that the service terminations were the result of pressure from their 
prudential regulator. Cadence Bank also terminated Advance America’s accounts without 
explanation. Advance America has not been able to find local banks to service certain stores that 
were affected by the terminations; many of the banks it contacted for that purpose had decided to 
exit the short-term small-dollar industry entirely due to regulatory pressure. No bank expressed a 
concern about Advance America; every bank based its determination on a sweeping judgment of 
the industry as a whole, an irrational judgment they were compelled to make by their regulator. 

Another CFSA member. Cash Tyme, has received termination notices for its accounts at 
three financial institutions. Two alluded to the regulatory environment. Fifth Third Bank 
infonned Cash Tyme, as it had infonned Advance America that the entire industry was “outside 
[its] risk tolerance.” Regions Bank informed Cash Tyme that it “ha[d] chosen to end 
relationships with certain types of customers deemed to be high risk.” Cash Tyme has been 
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unable to find substitute banks to service certain stores affected by the terminations, nor has it 
been able to find a bank that will provide ACH services. 

CFSA Member Speedy Cash, Inc. (Lending Bear), after a seventeen year banking 
relationship, also received a termination notice from Bank of America. A bank officer told 
Speedy Cash, Inc. that Bank of America was “exiting the payday advance space,” expressed 
regret at the decision, and led it to believe that the termination decision depended only on Speedy 
Cash Inc.’s classification as a short-term credit provider. Indeed, Speed Cash recently received a 
formal notice from Bank of America that its small business accounts would soon be closed 
“based on the nature of your business and associated risks.” Furthermore, two of its current 
banking partners now refuse to open new accounts for Speedy Cash, Inc. 

CFSA member Xpress Cash Management likewise received a termination notice from 
Fifth Third Bank that explained that the short-term small-dollar loan industry is “outside [its] risk 
tolerance.” 

The foregoing specific examples of banks that have terminated their relationships with 
CFSA members as a result of regulatory pressure are merely illustrative of the severely harmful 
effects of Operation Choke Point on the short-term credit industry. Numerous other CFSA 
members have lost longstanding, positive banking relationships, despite their law-abiding and 
responsible business practices. 

The agencies and DOJ knew early on that their coordinated, coercive campaign of 
backroom pressure tactics was succeeding in prompting banks “to exit or severely curtail” 
business with all short-term credit providers, and that “banks may have therefore decided to stop 
doing business with legitimate lenders.” Six-Month Status Report Mem. at 10. 
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Because short-term credit providers cannot survive without access to banking services. 
Operation Choke Point has begun to have its intended and necessary effect. As one internal DOJ 
memorandum noted, “a large Internet payday lender decided recently to exit the business due to 
difficulties securing a bank or payment processor relationship.” Memorandum from Michael S. 
Blume, Dir., Consumer Prot. Branch of U.S. Dep’t of Justice, to Stuart F. Delery, Principal 
Deputy Ass’t Att’y Gen., Civil Div. of U.S. Dep’t of Justice 2 (July 8, 2013), in COMM. R.F.P. ON 
Operation Choke point app. at HOGR-3PPP000166. The regulators celebrated “this type of 
positive conduct.” Six-Month Status Report Mem. at 6, 10. 

Violating basic principles of due process should not be a cause for celebration. These 
agencies should put an end to the lawlessness engendered by Operation Choke Point and end the 
unfair targeting of lawful businesses and entire industries. 
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Mr. Bachus. Thank you, Mr. Thompson. 

Mr. Weinstock. 

TESTIMONY OF PETER WEINSTOCK, 

PARTNER, HUNTON & WILLIAMS LLP 

Mr. Weinstock. Chairman Bachus, Ranking Member Johnson, 
and Members of the Subcommittee, the U.S. Department of Justice 
created Operation Choke Point ostensibly to combat consumer 
fraud. However, it has become apparent that the program instead 
seeks to irradiate disfavored business. 

To do so, the program uses aspects of FIRREA to threaten in- 
junctions and civil penalties against banks that provide access to 
the payment system for certain merchants and payment processors 
to whom they provide services. 

Without access to the banking and payment systems, these enti- 
ties are unlikely to continue operating. This was precisely the 
DOJ’s goal from the outset. 

Banks are disassociating with customers engaged in lawful be- 
havior, not simply customers whose activities may be fraudulent, 
as bankers try to define the next targets of the DOJ’s efforts. 

The DOJ even acknowledged the prospects for such parties’ 
banking relationships to be collateral damage to its initiative. 

With Operation Choke Point, the DOJ is starting from the 
premise that certain lines of business or industries are anathema 
and then working backward to find legal violations. 

Using FIRREA to implement Operation Choke Point, the govern- 
ment can issue subpoenas, take depositions, and seek civil damages 
against entities committing wire fraud or mail fraud, affecting Fed- 
erally insured depository institutions. In doing so, the DOJ need 
only meet the lower evidentiary burden of proof by a preponder- 
ance of the evidence to demonstrate fraud. 

The DOJ’s objective, however, is not to bring any action against 
those suspected of committing fraud, but to cause banks to “scruti- 
nize their account relationships and, if warranted, to terminate 
fraud-tainted processors and merchants.” 

As a result of the DOJ’s use of FIRREA, banks have been forced 
to choose between, at a minimum, incurring significant discovery 
and compliance costs and potentially accepting costly penalties, on 
one hand, or terminating existing relationships with processors and 
merchants, on the other hand, even if they are operating lawfully. 

The DOJ has calculated the bank’s sensitivity to the costs of re- 
sponding to the DOJ’s inquiries, let alone to civil and criminal li- 
ability and regulatory action. Their goal is to cause a bank to “scru- 
tinize immediately its relationships with processors and fraudulent 
merchants and to take necessary action,” i.e., to cut them off. 

In Operation Choke Point, the determination of whether a mer- 
chant is fraudulent is determined by the DOJ based on a line of 
business rather than by any adjudication where those who are ac- 
cused are afforded due process. 

DOJ believes that legitimate banks will become aware of perhaps 
unrecognized risks and corrupt banks will be exposed. In other 
words, a bank that does not agree with the DOJ’s assessment, per- 
haps based only on return rates and violations of State laws which 
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the DOJ concedes is only a red flag of potential fraud, will deem 
to be corrupt and subject to legal action. 

Operation Choke Point has had a chilling effect on banks’ will- 
ingness to transact business with processors and merchants where 
the reward cannot compensate enormous costs and potential expo- 
sure. 

FIRREA was passed in response to the savings and loan crisis. 
The goal of FIRREA was to make those who committed outright 
fraud and insider abuse against depository institutions pay the 
price for those actions. The DOJ is clearly stretching the limits of 
FIRREA in the context of Operation Choke Point. 

With the current analysis by the DOJ, intent is turned on its 
head. Instead of using FIRREA to protect banks from fraud, the 
DOJ is prosecuting banks for conduct disfavored in businesses that 
are disfavored using discovery and draconian subpoena power. En- 
tities shut out of one bank have little hope of establishing a subse- 
quent banking relationship and will become defunct without an op- 
portunity to defend themselves. 

While I am not championing the efficacy of payday lending, there 
are undoubtedly some organizations that operate lawfully and pro- 
vide un-bank customers with a service that such customers believe 
is valuable, certainly one less dangerous than engaging a loan 
shark. 

Indeed, a review of the development of Operation Choke Point re- 
veals the DOJ’s new technique. As noted by internal memoranda 
on Operation Choke Point, the DOJ’s primary target is the short- 
term lending industry. 

Brandishing FIRREA as a sword, DOJ chose to go after a num- 
ber of banks that were doing business with third-party payment 
processors to get them to cease providing services to those entities. 

DOJ stunningly proposed identifying ten suspect banks for ana- 
lyzing return rate data, among other criteria. However, the DOJ’s 
standard for identifying fraud was arbitrary and relied almost ex- 
clusively on NACHA average return rates and potential violations 
of State law. 

NACHA does not define a 3 percent level. NACHA does have a 
1 percent level for unauthorized transactions as an indicator of 
fraud. NACHA doesn’t have a level for not sufficient funds. 

The chilling effect of Operation Choke Point is not limited to 
DOJ actions. Instead, it is partially predicated on the notion that 
reputation risk arises when banks transact business with proc- 
essors and high-risk merchants. What constitutes reputational risk, 
however, is not clearly defined. 

The FDIC issued a financial institution letter that explains rep- 
utation risk as a risk arising from negative public comment and 
adds any negative publicity involving the third party, whether or 
not the publicity is related to the institution’s use of the third 
party, could result in reputation risk. 

Sarah Raskin, Federal Reserve Board Governor, explained rep- 
utation risk in a speech as the risk to enterprise value from — to 
brand recognition and customer loyalty. Raskin further added that 
supervision of banks is necessary in order to prevent the accumula- 
tion of reputation risk to the extent it constitutes a hidden expo- 
sure. 
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These comments illustrate the vague and subjective standard 
now being wielded by the Federal Government against banks who 
are doing business with disfavored industry. The guidance plainly 
does not distinguish between lawful and fraudulent activity. 

Reputational risk is not legal risk. Regulatory authorities proffer 
no standard of how to evaluate whether, as Raskin states it, that 
reputation risk is accumulating and that any exposure is material 
to safety and soundness. 

The OCC and the Fed in the fourth quarter of last year issued 
guidance on third-party risk that requires financial institutions to 
risk-assess their customer base and to engage in extensive review 
of the compliance management systems of their customers. In ef- 
fect, bankers now have to police their customers’ compliance man- 
agement systems. 

This goes well beyond the BSA’s know-your-customer require- 
ments. This gets into the burden on banks to police whether cus- 
tomer — disclosures to their customers are deceptive, whether cus- 
tomers are engaging in improper activity. 

Basically, they have to police all of their customers’ activities. 
What cost is that imposing on third parties? What cost when the 
third parties have to have bank-like compliance management sys- 
tems? And what is that going to do to our economy? 

So, undoubtedly, there is a chilling effect going on. Bankers are 
trying to evaluate high-risk customers and then determine which 
of those will be next on the regulatory or government list and then 
terminate them. Bankers are making the business decision to de- 
risk their customer base accordingly. 

Thank you. 

[The prepared statement of Mr. Weinstock follows:] 
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Legal Ramifications of Operation Choke Point 

By Peter Weinstock, Hunton & Williams LLP 1 


L Background 

The U S. Department of Justice (“DOJ”) created Operation Choke Point ostensibly to combat 
consumer fraud. 2 However, it has become apparent that the program instead seeks to eradicate 
disfavored businesses. To do so, the program uses aspects of the Financial Institutions Reform, 
Recovery, and Enforcement Act of 1989 (“FIRREA”) 3 to threaten injunctions and civil penalties 
against banks that provide access to the payment system for certain merchants and third-party 
payment processors (“TPPPs”) to whom they provide services. Without access to the banking 
and payments system, these entities are unlikely to be able to continue operating. 4 This was 
precisely the DOJ’s goal from the outset.' Banks are disassociating with customers engaged in 
lawful behavior, not simply customers whose activities may be fraudulent, as bankers try to 
define the next targets of the DOJ’s efforts. The DOJ even acknowledged the prospects for such 
parties’ banking relationships to be collateral damage of the DOJ’s initiative. 6 

With Operation Choke Point, the DOJ is starting from the premise that certain lines of business 
or industries are anathema and then working backward to try to find legal violations. Using 
Section 951 of FIRREA to implement Operation Choke Point, the Government can issue 
subpoenas, take depositions, and seek civil damages against entities committing mail or wire 
fraud “affecting a federally insured financial institution.” 7 In doing so, the DOJ need only meet 
the lower, civil evidentiary burden of proof (“by a preponderance of the evidence”) to 
demonstrate fraud. 8 The DOJ’s objective, however, is not to bring any action against those 
suspected of committing fraud, but to cause a bank “to scrutinize their account relationships and, 
if warranted, to terminate fraud-tainted processors and merchants.” 9 Over the bank’s head, the 


Peter Weinstock is a partner in Hunton <& Williams’s Dallas office whose practice focuses on corporate 
and regulatory representation of financial institution franchises. This written statement presents the views of Mr. 
Weinstock and does not necessarily reflect those of Hunton & Williams or ils clients. The information presented is 
for general information and education purposes. No legal advice is intended to be conveyed. Mr. Weinstock may 
be reached at (214) 468-3395 orpwcinstock@himton.com. 

2 Darrell Issa, Tiie Department or Justice’s "Operation Choke Point' " : Illegally Choking Off 
Legitimate Businesses? (U.S. House of Representatives Committee on Oversight and Government Reform, 2014) 
at 2 (citing Letter from Peter J. Kadzik, Principal Deputy Assistant Attorney General, Office of Lcgis. Affairs, U.S. 
Dep t of Justice, to Rep. Blaine Luctkcmcycr (Sept. 12, 2013) (stating ”[t]hc Department seeks to combat fraud and 
other unlawful practices in the payment system, and our efforts are focused on all those engaged in illegal 
activity."); Congressional staff briefing with the Deputy Assistant Attorney General for Consumer Protection, Civil 
Div., U.S. Dep t of Justice, on Sept. 20, 2013). 

3 Codified under 12 U.S.C.A. § 1833a. 

' Issa at 1 . 

5 See generally Nov. 5, 2012 Letter from Joel M. Sweet to Stuart F. Delery, Acting Assistant Attorney 
General (Civil Division) (HOGR-3PPP000020). 

0 See, e.g., Nov. 5, 2012 Letter from Joel M. Sweet to Stuart F. Dclciy, Acting Assistant Attorney General 
(Civil Division), at 2-3 (HOGR-3PPP000020). 

7 See 12 U.S.C.A. § 1833a(a), (c). 

8 See A Hyson Baker & Andrew Olmcti, FIRREA: The DOJ’s Expansive ( and Expensive) Tool of Choice, 28 
No. 10 Westlaw Journal Delaware Corporate at 1 (2013). 

' See, e.g, Nov. 5, 2012 Letter from Joel M. Sweet to Stuart F. Delery, Acting Assistant Attorney General 
(Civil Division), at 3 (HOGR-3PPP()()0020). 
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DOJ holds FIRREA’ s expansive reach, lower burden of proof, heavy monetary penalties, and 
ten-year statute of limitations. 10 

As a result of the DOJ’s use of FIRREA, banks have been forced to choose between, at a 
minimum, incurring significant discovery and compliance costs and potentially accepting costly 
penalties, on one hand, or terminating existing relationships with TPPPs and other merchants that 
may be operating lawfully, on the other hand. The DOJ has calculated that banks’ sensitivity to 
the costs of responding to the DOJ’s inquiry, let alone to “civil/criminal liability and regulatory 
action,” will cause a bank “to scrutinize immediately its relationships with [TPPPs] and 
fraudulent merchants and . . . take necessary action [/.<?., cut them off].” 11 In Operation Choke 
Point, the determination of whether a merchant is fraudulent is determined by the DOJ based on 
a line of business, rather than by an adjudication where those w'ho are accused are afforded due 
process. The DOJ believes that “[Ijegitimate banks will become aware of perhaps unrecognized 
risks and corrupt banks will be exposed.” 12 In other w'ords, a bank that does not agree with the 
DOJ’s assessment, perhaps based only on return rates — which the DOJ concedes is only a “red 
flag of potential fraud” — will be deemed “corrupt” and subject to legal action. 11 Operation 
Choke Point has had a chilling effect on banks’ ability to transact with such TPPPs and 
merchants where the reward cannot compensate for the potentially enormous costs and potential 
exposure under the DOJ’s use of FIRREA. Banks are forced to drop these entities, but the 
affected TPPPs and merchants have no recourse to combat this penalty. It effectively becomes 
an extra-judicial permanent injunction by the agreement of government lawyers and an 
(appropriately) skittish bank. 

In stating that its goal is to “positively sensitize the banking industry to third-party payment 
processor risk,” 14 the DOJ is launching an offensive against TPPPs and classically using 
enforcement to regulate, if not legislate away, organizations that may very well be legitimate. 
Such an approach is the province of rule-making under statutory authority with appropriate 
notice and opportunity to comment, and potentially, to challenge the adoption of the rule. This 
broad expansion of FIRREA triggers concerns that the DOJ has exceeded its authority under the 
statute or, if it has not done so, that the statute has no outer limit and is thus vague. 

IL Flaws in the DOJ’s Approach 

FIRREA was passed in response to the Savings and Loan crisis of the late 1 980s in part to curb 
“outright fraud and insider abuse” committed against depository institutions. 15 Through 
FIRREA, Congress aimed to protect depositors in financial institutions and federal taxpayers 
from fraudulent conduct that could result in a taxpayer-funded bailout. 10 With the federal 
government’s current analysis, that intent is turned on its head. Instead of using FIRREA to 
protect banks from fraud, the DOJ is prosecuting banks for conducting disfavored business and 
then using discovery, including a draconian subpoena power, to try to find activity that can be 


10 12 U.S.C.A. § 1833a(li>. 

11 Nov. 5, 2012 Letter from Joel M. Sweet to Stuart F. Dclciy, Acting Assistant Attorney General (Civil 
Division), at 2-3 (HOGR-3PPP000020). 

12 Id. at 3. 

' Id. at 2-3 (emphasis added). 

11 Id at 3. 

‘ See Issa at 3. 

16 Id at 455. 
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deemed illegal. Entities shut out of one bank have little hope of establishing a subsequent 
banking relationship and will become defunct without any opportunity to defend themselves. 
While 1 am not championing the efficacy of payday lending, there are undoubtedly some 
organizations that operate lawfully and provide unbanked customers with a service such 
customers believe is valuable, one less dangerous than engaging a loan shark. 

Indeed, a review of the development of Operation Choke Point reveals this new technique. As 
noted by the House Committee on Oversight and Government Reform, “internal memoranda on 
Operation Choke Point clearly demonstrate that the [DOJ’s] primary target is the short-term 
lending industry. . . ” 17 Brandishing FIRREA as a sword, the DOJ chose to go after a number of 
banks that were doing business with TPPPs to get them to cease providing services to these 
entities. There was no proof when such decision was made that any of these banks were affected 
by fraud. Instead, in designing Operation Choke Point, the DOJ stunningly proposed identifying 
ten “suspect” banks for analyzing return rate data, among other “criteria.” 18 However, the DOJ’s 
“standards” for identifying fraudulent activities were arbitrary and relied almost exclusively on 
NACHA average return rate instead of potential violations of state — not federal — consumer 
protection laws. 

NACHA is a private trade organization that administers and facilitates private-sector operating 
rules for ACH payments, which define the roles and responsibilities of financial institutions and 
other ACH Network participants. 19 The DOJ has alleged that an overall return rate of 3% on all 
of a merchant’s ACH transactions should be the benchmark for what is considered fraud, 
because it is higher than the industry average tracked by NACHA. This is misleading. The 
overall return rate does not distinguish among the type of the return (unauthorized entries are 
very different from returns due to insufficient funds) or the nature of the transaction or customer 
base. Thus, the DOJ is not distinguishing between unauthorized return rates and returns due to 
insufficient funds. Furthermore, the DOJ compares the card networks' rate of disputed 
transactions to the overall ACPI return rates, even though those are two completely disparate 
numbers. Card network disputed rates do not include transactions that are declined when the 
card is swiped. ACH returns, on the other hand, can include cases of insufficient funds or 
incorrect account information, along with debits disputed by the accountholder. The test 
employed by the DOJ to catch fraud may have resulted in legal businesses being considered 
fraudulent, too. It certainly resulted in dozers of banks and TPPPs receiving subpoenas. 
Accordingly, under the standards the DOJ is promulgating, it may advise a bank that a TPPP is 
engaged in fraud, ignoring legitimate reasons for a relatively high return rate, and expect the 
bank to terminate the relationship or incur significant discovery costs. 

The DOJ has not commented on why it failed to take into account the long-standing relationships 
between the banks and the TPPPs, the previous reviews of the banks and TPPPs conducted by 
examiners, and the Treasury Department determination that TPPPs are not money transmitters 
and are not required to register with FinCEN. The DOJ’s proposed use of mathematical proxies 
to allege fraud is a frightening prospect and far afield from what most federal prosecutors do 


1 Tssa at 5. 

’ See Nov. 5, 2012 Letler from Joel M. Sweet to Sluarl F. Delery, Acting Assistant Attorney General (Civil 
Division), al 4 (HOGR-3PPP000020). 

19 See About SACHA, accessible al https://www.nacha.org/abouL 
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before bringing a fraud case. This type of activity has the potential to erode confidence in the 
DOJ 

The ‘"chilling effect” of Operation Choke Point is not limited to the DOJ’s actions. Instead, it is 
partially predicated on the notion that “reputational risk” arises when banks transact with TPPPs 
and certain “high-risk” merchants. 211 What constitutes “reputational risk,” however, is not clearly 
defined. The Federal Deposit Insurance Corporation (“FDIC”) issued a Financial Institution 
Letter entitled “Guidance for Managing Third Party Risk” that explains reputation risk as “the 
risk arising from negative public opinion” and adds “any negative publicity involving the third 
party, whether or not the publicity is related to the institution’s use of the third party, could result 
in reputation risk.” 21 Federal Reserve Board Governor Sarah Raskin explained “reputational 
risk” in a speech by stating that “enterprise value comes from intangible assets such as brand 
recognition and customer loyalj^ that may not appear on the balance sheet but are nevertheless 
critical to the bank’s success.” Raskin further added that supervision of banks is necessary in 
order to prevent the accumulation of reputational risk to the extent that it constitutes a hidden 
exposure. 23 These comments illuminate the vague and subjective standard now being wielded by 
the federal government against banks doing business with disfavored industries. The “guidance” 
plainly does not distinguish between lawful and fraudulent activity. Reputational risk is not legal 
risk. Regulatory authorities proffer no standard of how to evaluate whether, as Raskin states it, 
that reputation risk is “accumulating” and that any “exposure” is material to safety and 
soundness. 

Moreover, the Office of the Comptroller of the Currency and the Board of Governors of the 
Federal Reserve System issued guidance in the fourth quarter of 2013 emphasizing the need for 
bankers to risk assess their customer base. 24 High-risk businesses require more extensive 
oversight, including potentially third-party testing of such parties’ compliance management 
systems (“CMS”). To further define such businesses that may give rise to reputational risk, the 
FDIC published an article on its website. 23 This article sets forth 30 merchant categories that are 
deemed to be “high risk” in nature. Examiners, and thus bankers, are using this list as a 
touchstone informing what business relationships are disfavored. However, the list of merchant 
categories included seems somewhat arbitrary. Other merchant categories possibly could present 
higher risk to banks, but are not included. Examples of potentially high risk businesses not 
included on the FDTC’s list include phone companies, financial advisors, personal trainers and 
tax preparation firms. Nevertheless, bankers have been relying on the FDIC list when 
determining with which firms to transact business. 


See Issa at 1 . 

21 See "Guidance for Managing Third Parly Risk.” FDIC, Financial Inslilulion Leller: Guidance for 
Managing Third Parly Risk, FIL-44-2008 (June 6, 2008). 

See Sarah Bloom Raskin, Federal Reserve Board Governor, Address to the 2013 Banking Outlook 
Conference at the Federal Reserve Bank of Atlanta (Feb. 28, 2013). 

“ See id. 

" 4 See "Guidance on Managing Outsourcing Risk. Board of Governors of the Federal Reserve System, SR 
13-19/CA 13-21 (Dec. 5, 2013); "Risk Management Guidance." OCC Bulletin 201.3-29 (Oct. 30, 2013). ’ 

^ See FDIC Supervisory Insighls - Summer 201 1, Managing Risks in Third-Party Payment Processor 
Relationships , accessible at 

hllp://wwvv. fdic.gov/iegulalions/examinations/supervisoiy7insighls/sisuml 1 /managing, html. 
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All of the guidance and the article regarding the “reputational risk” standard and high risk 
enterprises were promulgated without the requisite notice and comment period and without any 
administrative record. The nature of this new approach to knowing your customer goes well 
beyond the mandates of the Bank Secrecy Act and the Anti-Money Laundering laws and the US 
PATRIOT Act. While those statutes focus on potential money laundering and financial fraud, 
the new focus is potentially much broader, requiring banks to police their customers’ CMS. 

III. Effects of the DOJ’s Overreach 

With the expansion of Operation Choke Point, many banks simply are ceasing to provide 
services to TPPPs or high-risk merchants. The result is that TPPPs and other merchants labeled 
“high risk” no longer have access to deposit systems from regulated financial institutions. 
Without this access, these businesses may be forced to shut down . 26 Small and mid-size 
businesses who use TPPPs will no longer have an economical option for processing payments. 
These businesses rely upon TPPPs, because costs are prohibitively high to establish electronic 
systems to access the banking system and go through a bank directly. In fact, the vast majority 
of payroll in this country and the tax payments for payroll are performed by TPPPs. Shutting 
down TPPPs will upend this method of doing business. Currently, TPPPs and their merchant 
customers are looking to adopt bank-like levels of CMS. The costs of such compliance must be 
paid. In short, among other flaws. Operation Choke Point threatens electronic access to the 
banking system or risks imposing costs on small businesses, both of which are crucial 
components of the economy. 

IV. Conclusion 

Operation Choke Point represents a fundamental shift in law enforcement and regulation. The 
DOI is using an obscure section of FIRREA intended to address those who caused losses to 
savings associations to justify imposing legal and regulatory pressure on banks serving 
disfavored businesses. As a result of Operation Choke Point, banks are forced to deny services 
to these disfavored entities or risk heavy civil penalties, criminal liability or regulatory action, 
even without any evidence that the banks have done anything wrong. TPPPs, in particular, have 
been targeted by the DOJ through these “back door” means. The DOJ is accomplishing its goal, 
but at what costs to the business community and consumers? 


" 6 It they seek to survive, these entities must turn to non-lraditional sources of credit, which come with a 
very high risk and lillle regulation. 
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Mr. Bachus. Mr. Holding, recognized for questions. 

Mr. Holding. Thank you, Mr. Chairman. 

Mr. Thompson, thank you for your testimony. 

There is a little bit of a discrepancy amongst the panel here. In 
his testimony, Professor Levitin states that there are no verified 
cases of banks terminating accounts in direct reaction to Operation 
Choke Point. 

I heard you testify differently than that. So, if you could, please 
explain where that discrepancy comes from. 

Mr. Thompson. Sure. And perhaps it is definitional in terms of 
what we mean by Operation Choke Point. But what I mean by that 
is the coordinated effort by the Department of Justice, the FDIC, 
the OCC, and the Fed to target certain high-risk industries. 

And this is what we saw in that subpoena and the attachment 
to the subpoena. And if that is what we mean by it, we have heard 
numerous instances of banks saying, “We are getting out of’ — “We 
are exiting this relationship,” relationships that often extend over 
a decade, almost 2 decades. 

And there has been no indication that there was a concern about 
the risk profile, that anything had changed in the risk profile of the 
short-term credit lender. Rather, it was regulatory pressure. That 
is what we are hearing, regulatory pressure, and it is clear that it 
is Operation Choke Point. 

Mr. Holding. And you are in the business of representing simi- 
larly situated entities on a daily basis. Correct? 

Mr. Thompson. Yes. That is right. 

Mr. Holding. The — you know, talking about these subpoenas, 
again drawing on your experience as a practicing attorney in this 
field, the — take a minute and walk through, you know, what hap- 
pens when a client gets a subpoena like this. You know, what is 
the ripple effect? And, ultimately, at the end of day, you know, 
what does it cost them to respond? 

Mr. Thompson. Well, it is a very significant cost in any number 
of respects. It starts with just answering the subpoena, which 
means retaining lawyers, number one. 

Number two, typically, then these subpoenas are looking for 
emails. The cost of production can be hundreds of thousands of dol- 
lars just in computer resources to do an email sweep and then to 
produce, depending upon the volume of material that is sought. 

And often, of course, the subpoena is a prelude to further inves- 
tigation, which would cost — could cost millions of dollars. And then 
you layer on top of that the bad publicity that comes from receiving 
this, the investigation. 

There is enormous pressure on the institution to make it — the 
pain stop. And I suspect, although I don’t know, that that is one 
of the reasons we see 50 subpoenas being issued, but only one case 
being — having to be filed, because there is huge asymmetric pres- 
sure when the government issues a subpoena on a recipient to try 
to make the pain stop. 

Mr. Holding. So if you are a financial institution, I mean, you 
are always looking at the bottom line, doing a cost -benefit analysis. 
Whether you take on a client or retain a client, you know, you cer- 
tainly do a risk analysis as to whether they will be able to repay 
their loans, whether they will be a profitable customer. 
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But then you add into that — you know, if they fall into one of 
these high-risk categories, as enumerated by the FDIC, the — you 
look at that and say, “You know, it could cost me a lot of money 
to have this person as a client.” Correct? 

Mr. Thompson. You are absolutely right. 

And it is not limited just to that. Because, as one of the panel- 
ists — or Members of the Subcommittee indicated earlier, regulators 
have a lot of different ways to apply pressure on a financial institu- 
tion. 

So, yes, you are right. The dollars and cents are huge. The nega- 
tive publicity is very significant. But, also, you want to try to stay 
on the right side of your regulators. And if you defy them, they 
have innumerable ways to get even with you. 

Mr. Holding. Thank you. 

Mr. Chairman, I yield back, in light of the vote. 

Mr. Bachus. Thank you. I appreciate that, Mr. Holding. 

Do you want to go ahead and begin to ask one or two questions 
and then we will break in maybe 2 minutes? We have 3 minutes 
left on the floor. Or do you want to come back? 

We will wait. 

We would like to come back. Are any of you all under a time re- 
straint? 

All right. We will — there are two votes on the floor? 

Mr. Johnson. That means everybody is on the clock? 

Mr. Bachus. I think that may be probably 30 minutes. Why don’t 
we do this. Why don’t we come back at 10 till. Is that all right? 
Or 15 till? That will give you a chance to get something to eat. We 
are going to come back at 15 till. Probably won’t come back. Let’s 
say 20 minutes. 20 minutes. 

Mr. Weinstock. How long do you think we will go from there, 
Mr. Chairman? 

Mr. Bachus. 20 minutes max. We will be out of here by 1:00, 
1:15. 

Mr. Weinstock. Thank you. 

Mr. Bachus. Is that okay? 

Mr. Weinstock. I am not on the clock. 

Mr. Bachus. Oh, no. Okay. So you are not getting paid right 
now. 

Mr. Weinstock. I am here of my own volition. 

Mr. Bachus. We will try to get you out of here pretty quick. 

Mr. Weinstock. Thank you, Mr. Chairman. 

Mr. Bachus. Of course, a professor gets paid by teaching classes. 
So he is a little better 

We will recess at this point. 

[Recess.] 

Mr. Bachus. The Subcommittee will come to order. 

My first question will be for Mr. Weinstock. 

Mr. Weinstock. Yes, sir. 

Mr. Bachus. Well, actually, no. That question has been asked. So 
George asked that question. I just saw where I marked it off. 

Mr. Talbott, people might be skeptical of the idea of an industry 
policing itself. Are there any economic incentives that explain why 
one could expect that the payment industry would do a good job of 
fighting fraud? 
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Mr. Talbott. Sure. Thank you, Mr. Chairman. Appreciate the 
question. 

Because fraud, in case of credit card or debit card, that is visited 
upon the consumer comes bank to not the consumer — the network 
rules prohibit banks or processors from charging the customer — be- 
cause that fraud comes back to the payments industry, we have to 
bear the cost of that fraud. 

We have a direct pecuniary interest ensuring that fraud is kept 
off the system. So in addition to it being good public policy, it is — 
comes directly out of our bottom line. So we have every incentive 
to ensure that fraud stays off the system. 

Mr. Bachus. All right. Thank you. 

Mr. Weinstock. Mr. Chairman, can I add a comment? 

Mr. Bachus. Yes. 

Mr. Weinstock. One thing people don’t realize is NACHA ap- 
plies fines very quickly if there are unauthorized transactions and 
the bank can’t show proof that the customer authorized the trans- 
action. 

After three, four instances, that equals a fine of over six figures. 
So it is not like it is a toothless exercise. If they don’t pay the fines, 
they can get kicked out NACHA. 

Mr. Bachus. Okay. Thank you. 

Mr. Levitin. Mr. Chairman, if I may add, I agree with all of 
that. But I think it is important to note that it is — only part, not 
all, of fraud costs come back to industry. 

Because what it — you don’t have perfect enforcement going on 
because a lot of consumers will just lump it on a small-dollar fraud. 
It is not worth complaining about $10 or $20 that are wrongfully 
debited. 

So when consumers complain, yes, the industry is at risk, but 
consumers often don’t complain about small-dollar frauds. 

Mr. Bachus. Professor, same point that we are discussing. You 
did — I think in your testimony you were the one that covered the 
fact that — you said a payday lender is out of business if he — out 
of business or insolvent, the payday lender’s bank bears the loss, 
and that that is one reason — justification, you know, for 

Mr. Levitin. That’s correct. 

Mr. Bachus. They can — but let me ask you this. You then went 
on and said banks already charge those merchants much higher 
fees for banking service precisely because of the risks they pose, 
over on page 11. 

So you — you know, you say that there is some risk, but then in 
another paragraph, you acknowledge that a bank can just set a 
higher fee. And you mention that there are a lot of businesses that 
just have higher return rates, I mean, as a — as a matter of just 
their business. So 

Mr. Levitin. Sure. Return rates do vary by industry. And it is 
important that we distinguish between absolute return rates and 
return rates because of unauthorized transactions. Not every re- 
turn — ACH return is because of an unauthorized transaction. 

Mr. Bachus. Yeah. And I agree with that. But, still, banks have 
an ability to adjust. 

Mr. Levitin. Oh, I agree completely, Mr. Chairman, and that is 
actually, I think, the important point, which is that, if Operation 
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Choke Point is imposing higher costs on high-risk merchants, there 
will be some banks — we have got almost 7,000 banks in the United 
States; it is far more than any other country has — there will be 
some banks that see this as a business opportunity and say, “Hey, 
archery store that got closed down, come to us. We are going to 
charge you more, but we will take your business. We will do the 
diligence on you. We can get comfortable with you. It is going to 
just cost you more.” 

And the market should correct this. You know, it may not be a 
perfect correction, but we should see a market correction. 

Mr. Bachus. Let me say this to you. You know, I know — I notice 
that you — and you are the witness that was called by the — by the 
Democratic party, you know — I mean, Democratic colleague. You 
actually talked about two or three times that justification for this 
is anti-money laundering. 

Mr. Levitin. I am sorry, Mr. Chairman. I didn’t understand. 

Mr. Bachus. You said — you, you know, criticized our attempts to 
hamper the Justice Department’s enforcement of anti-money laun- 
dering law and, you know, you actually say that is what they are 
trying to do, prevent anti-money laundering. 

Because that is the justification for this program. Right? 

Mr. Levitin. I think that is correct, sir. Operation Choke Point, 
if you look at the actual complaint, that is the — you know, the — 
the — it — the problem that was alleged with Four Oaks Bank was 
a failure to essentially know your customer. With the Bank Secrecy 
Act anti-money laundering 

Mr. Bachus. And that has to do with money laundering. 

Mr. Levitin. That is right. And it is important to recognize that, 
when you have an anti-money laundering problem, even if it is 
from, let’s say, a payday lender, that can actually implicate much 
broader things because, if a bank doesn’t know its customer, it 
doesn’t actually know what that transaction is. 

Just because a business says it is a payday lender, it can also 
be, you know, engaged in other business, allowing other trans- 
actions to be routed and look like they are payday loans. 

Mr. Bachus. Right. Yeah. And, you know — and I mention this 
because that is an argument that we are hearing from some of our 
colleagues. 

You know, you say Operation Choke Point is ultimately an anti- 
money laundering enforcement that requires the banks to take 
their know-your-customer duties seriously. 

And that is — the Justice Department, you know, on one hand, 
has said it is for this reason, but then they said, well, actually, it 
is to prevent money laundering. 

But do — do payday lenders launder a lot of money? Is there any 
evidence of that? 

Mr. Levitin. As to actual money laundering, I don’t know of any 
evidence on that. We do know that there is high return rates, how- 
ever. 

Mr. Bachus. Well, yeah. But I am talking about — you know, I 
am talking about money 

Mr. Levitin. And — well, I think it is important that we define 
what we are talking about with money laundering. Money laun- 
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dering is not limited to narcotics or terrorism. Money laundering 
is just proceeds of any illegal transaction. 

Mr. Bachus. Yeah. Right. 

Mr. Levitin. And to the extent that you have illegal transactions 
going on in any industry, payday loans or what have you, then, yes, 
there can be a money laundering problem. 

Mr. Bachus. Are these hundred-dollar loans? But you said there 
is no evidence that the 

Mr. Levitin. I don’t know of any evidence. I have never inves- 
tigated this. 

Mr. Bachus. Yeah. Right. Okay. 

Mr. Levitin. I would note, though 

Mr. Bachus. I am sure potential is there for any 

Mr. Levitin. Of— sure. 

Mr. Bachus [continuing]. By any industry. I mean, you know, in 
fact, people buy cars. One of the primary ways is they go to a car 
dealership. They buy a very expensive car. Then they turn around 
and they sell it. And they deposit the proceeds and they launder 
it that way. But, you know, car dealerships are 

Mr. Levitin. There is a particular concern, though, in that some 
payday lenders are also money services businesses and they are 
sometimes engaged in doing international remittances. And that 
raises particular money laundering concerns. 

Mr. Bachus. I think the — you know, if you are talking about a 
hundred dollars at a time, it is kind of hard to 

Mr. Levitin. Well, that — but that is the way to do money laun- 
dering. It is called smurfing. 

Mr. Bachus. No. No. Actually 

Mr. Levitin. You do it in small transactions so you don’t get 

Mr. Bachus. You know, cars are a $10,000 transaction, I think. 
Money laundering, through — you know, when they do drugs to 
money, they are converting — they are not doing it a hundred dol- 
lars — 

Mr. Levitin. Actually, I disagree with you on that, sir, because 
banks have — have to file suspicious activity reports for anything 
over $10,000. 

The idea is you keep your — if you want to be a money launderer, 
you keep your transactions small and you don’t put them at 9,999 
because that is also suspicious. You make smaller transactions, not 
necessarily a hundred. 

Mr. Bachus. No. No. I 

Mr. Levitin. But you break it up into little pieces 

Mr. Bachus. Maybe 2,000, 3,000. Or you buy — you know, there 
are — people buy appliances and they ship them back — out of the 
country. You know, there is a lot of that. 

But I have seen no — I mean — I have never seen any evidence 
that people are cashing their paychecks — I mean, a paycheck is a — 
that is a — that is not cash. 

They are actually taking a check. And there is no need to money- 
launder that. And they are turning it into cash. They are not turn- 
ing cash into a check. 

So — but, anyway, I — we are — I have done 7 minutes. We will — 
my colleague will do 7. And then we will turn — I just was pointing 
out 
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Mr. Johnson. Okay. Thank you. 

Professor, you are a professor. And you three gentlemen, Mr. 
Talbott, Mr. Thompson, and Mr. Weinstock, are practicing lawyers. 
Is that correct? 

Mr. Tat/bott. Yes. 

Mr. Thompson. Yes. 

Mr. Talbott. I am a lobbyist 

Mr. Johnson. You are a lobbyist. 

Mr. Talbott [continuing]. With a law degree. 

Mr. Bachus. He is government affairs. 

Mr. Talbott. I am not apologetic. 

Mr. Bachus. You are government affairs. 

Mr. Johnson. The three of you also have clients; do you not? 

Mr. Thompson. Yes. Yes, sir. 

Mr. Bachus. And, Mr. Thompson with Hunton & Williams — oh. 
I am sorry. 

Mr. Weinstock with Hunton & Williams, you have many clients 
in the financial services industry; do you not? 

Mr. Weinstock. Yes. 

Mr. Bachus. And how about you, Mr. Thompson? 

Mr. Thompson. I do not. In the past, I have represented, but not 
at present. I have some. 

Mr. Johnson. And Mr. Talbott? 

Mr. Talbott. Members of the association of ETA are payment 
companies. Some are financial institutions, per se. Others are not. 

Mr. Johnson. Okay. And — but, now, Mr. Thompson, you have 
done over 50 depositions. Did I hear that earlier? 

Mr. Thompson. I think it is several hundred, in fact. But only 
two of Members of Congress, Senator Snowe and Representative 
Meehan back in the McCain-Feingold case. 

Mr. Johnson. Okay. And you did that work in connection with 
your job responsibilities where? 

Mr. Thompson. At Cooper & Kirk. I have been there since 1996. 

Mr. Johnson. And so that law firm does represent clients in the 
financial services industry? 

Mr. Thompson. We have. Yes. 

Mr. Johnson. And so — and I — and I suppose, in a perfect world, 
a perfect corporate world, a perfect free market corporate world, a 
perfect free market Ayn Rand-style world, there be no regulations 
on banks at all. 

Would you agree with me on that, Mr. Talbott? 

Mr. Talbott. Theoretically, if you asked Ayn Rand, I think she 
would answer that question in the positive. 

Mr. Johnson. Well, how about you? 

Mr. Talbott. I think that there is a need in — for some regula- 
tions some places, financial services probably less so than other 
areas. But there is a value to having some regulations. 

Mr. Johnson. Mr. Thompson? 

Mr. Thompson. My clients are not contesting the validity of any 
of the regulations or 

Mr. Johnson. No. My question is: Would you agree that that 
would be a perfect world for corporations, to not have any rules or 
regulations 

Mr. Thompson. No. 



182 


Mr. Johnson [continuing]. And they could pretty much self-regu- 
late? 

Mr. Thompson. No, Congressman. That 

Mr. Johnson. Is that the kind of world that we want, Mr. 
Weinstock? 

Mr. Weinstock. I never read the book. So I am not exactly sure 
why a Rand-perfect world would be. But I think what we are all 
saying is what is appropriate is balance in regulation. 

Mr. Johnson. Well, now, how can we have reasonable regula- 
tions if the banking institutions don’t want to deal with the poten- 
tial loss of customers because they determine for themselves that 
their reputational risks — that the reputational risks are not worth 
the business and you have to also do more oversight, got to do 
more — the costs of doing business for certain businesses is high be- 
cause of regulation, and you would prefer to not have to — for your 
clients to not have to incur those costs. And I understand that. 

But where do we draw the line? Where is regulation meaningful 
and reasonable and in the public interest? 

And so that is a fundamental question I think we have to deal 
with as opposed to an incendiary guilty-until-proven-innocent study 
of propriety and legal authority for the Justice Department’s Oper- 
ation Choke Point. 

I mean, Operation Choke Point has only resulted in one civil ac- 
tion. Subpoenas have been sent out to other institutions. There are 
ongoing investigations. 

But a settlement in a civil case — and we are sitting up here 
wasting, you know, your time bemoaning the fact that your clients 
have to incur costs of doing business. 

I mean, you know, when is the — when do we — who protects the 
consumer, which is the real customer? 

Mr. Weinstock. Can I respond? 

Mr. Johnson. Yes. 

Mr. Weinstock. In terms of the level of regulation, as they say 
in East Texas, if you hang the meat too high, the dogs won’t jump. 

And the problem for our client base, which they are community 
banks, they are the lifeblood of their local communities, is that, if 
the level of regulation is such that they have a duty to police all 
of their customers, their scripts 

Mr. Johnson. Well, shouldn’t that be just a normal cost of busi- 
ness, that you do your due diligence and you make sure that cer- 
tain benchmarks are met with enhanced scrutiny, like rate of re- 
turns in excess of 1.5 percent? 

Isn’t it — I mean, isn’t that the regulations of your industry, Mr. 
Talbott? 

Mr. Talbott. Yes. 

Mr. Johnson. And so, if — if regulators or the Department of Jus- 
tice notes some benchmarks that have been met which trigger sus- 
picion, you all seem to be opposed to DOJ following up on that. You 
just want there to not be a loss of the customer 

Mr. Weinstock. That is not what we are saying, Congressman. 

Mr. Johnson [continuing]. And you don’t want a loss of the cost 
of doing business, and it just seems very Utopian to me. 

Mr. Weinstock. If — in terms of the D/2 percent, that is really a 
red hearing. That is an average based on lots of different NACHA 
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transactions. The DOJ disowned the 3 percent, which was just 
mathematically doubling the IV 2 percent average. 

NACHA, which is the agency that calculates the averages, never 
indicated that it is an indicator of fraud. The DOJ took it on itself 
and then at this hearing disowned the 3 percent. 

Unquestionably, banks have an obligation to know their cus- 
tomer. Banks are complying with that obligation to know the cus- 
tomer. 

Where this is all insidious is if the level of regulation and the 
level of supervision is such where the bankers don’t believe they 
can ever chin the bar, they can ever jump and catch the meat. 

Then their smart thing to do is to de-risk, cut the customer off. 
And the costs we are talking about are access to the lifeblood of an 
electronic economy. 

Mr. Johnson. Yeah. Well 

Mr. Bachus. Actually, we did 7 minutes. So it is 8V2. You can 
go ahead, if you have got another question, and then I will 

Mr. Johnson. I just wanted to ask Professor Levitin did he have 
anything he wanted to say in response to what we have heard. 

Mr. Levitin. Again, I would just say that I am not sure that — 
I am not sure I would agree with Mr. Weinstock. 

Certainly for some banks they will decide that it is not worth- 
while serving high-risk customers. They just can’t get — that they 
are afraid that their compliance costs are just going to be too high 
to get comfortable with it. 

But we have nearly 7,000 banks. Unless we assume that we have 
a real market failure in the banking industry in this particular 
area, there will be banks that will step up and serve these high- 
risk clients. 

They will start specializing in it. They are going to do more dili- 
gence. It will cost them more. It will cost the clients more. It will 
cost Mr. — and high-risk businesses will have to pay more for access 
to the banking system. 

But that is exactly the way it should be. Parties should bear 
their own risk. If you are imposing costs on the system, you should 
have to internalize them. And I don’t think there is anything wrong 
with that. 

Mr. Johnson. Well, I think that would be the way that Ayn 
Rand would want it to be. 

Mr. Levitin. I would just add it is not clear to me that markets 
exist except with regulation. If you try and imagine a totally un- 
regulated market, I think that looks like the Mogadishu arms ba- 
zaar, and I don’t think that is the way we want our economy to 
operate. 

Mr. Bachus. Let me start with that. I somewhat — I agree with 
you. I think that the market needs to be regulated. 

That is really why I am just, you know, disturbed about payday 
lenders, short-term lenders, being put out of business. Let me ex- 
plain why. And I think history is a good teacher. 

Mr. Johnson talks about a perfect world. In a perfect world, there 
will be no payday lenders. But there always have been. In the 
South, do you know who the payday lender was in many cases? 

Mr. Levitin. It was often the employer. 
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Mr. Bachus. It was — no. It was — there were some — some occa- 
sions where the employer — you are absolutely right. You had the 
company store where people bought things 

Mr. Levitin. I was thinking of Faulkner, actually. He has got 
Old Man Snopes loaning sawmill workers a dime on Sunday. And 
they are supposed to pay it back with a penny the next week. 

Mr. Bachus. That is right. 

Mr. Levitin. Never asked for the dime back. Just keeps taking 
a penny every week. 

Mr. Bachus. And I actually had two employers and they — many 
times was a high interest rate. They don’t loan money anymore. I 
mean, I don’t know of any — very few cases. You don’t have a lot 
of company stores. 

What you do have is you have the sheriff in those counties or you 
have a guy that is just a self-appointed guy that stands outside 
the — used to stand outside the gate when people got their pay- 
check. You know, he — or — you know, he — he was waiting to get his 
money back. During the week, he had loaned at a 50 percent or a 
30 percent. 

A lot of times, though, it was — it was totally unregulated. And 
people got their arms broken. People got their fingers mashed. Peo- 
ple got beat up. So we — States wanted it regulated, and they set 
rules. And that is the rules we have today. 

So these payday lenders are — you know, if you — if they go out of 
business, you are going to have the guy at the gate getting his 
money back. And if he doesn’t get his money back, kind of like in 
the — gambling used to be. You know, when you have unregulated 
gambling, people get — people get hurt, people get killed. 

So, really, you shut these down, you are going to have people 
loaning money. And they are going to be unregulated. They are not 
going to answer to anybody. So this isn’t about regulation. It will 
be Mogadishu again, like you said, I mean, about something else. 

I just say consider that. And you talk to anyone that ran a plant 
in the South, they will tell you there was always a payday lender. 
And — you know, and a lot of times you share for the probate judge. 

That is how they made their money. There were other things 
that — they used to make their money on illegal whiskey by pro- 
tecting some people. They were in the protection business. 

Mr. Levitin. Mr. Chairman, I think it is important to note that 
payday loans basically don’t make money absent customers get 
stuck in a — in a debt trap. 

Let me illustrate. Online payday lenders buy leads. If you go to 
a Web site looking for a payday loan, that is actually a lead-genera- 
tor’s Web site 

Mr. Bachus. No. I understand. 

Mr. Levitin [continuing]. Get auctioned off. 

Mr. Bachus. Professor, what I am saying, you know, you — in a 
perfect world, I would never argue with you that, you know, it — 
but I would tell you there will always be a payday lender, and it 
will be unregulated or regulated. Those are our two choices. 

You know, one thing you do is you talk about Congress should 
not be using its oversight power to subsidize these businesses. You 
say that twice. 

Mr. Levitin. That is correct. 
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Mr. Bachus. And you say payday lenders, online gun shops, es- 
cort services, online gambling parlors — now, they are all illegal. 
That is flat out prohibited. 

Mr. Levitin. Actually, I am not sure that any of those are, per 
se, illegal. There is a small sliver of online gambling 

Mr. Bachus. Yeah. The wire 

Mr. Levitin. Similarly, escort services, if they are very narrowly 
only companionship 

Mr. Bachus. Yeah. But I will just say most of your gambling on- 
line. You know, it is hard to stop. A lot of them are overseas. But 
purveyors of drug paraphernalia and racist material, pornog- 
raphers that serve no clear public service. 

But, you know, you — when you get into saying that, you are 
equating short-term lenders. I mean, you are making a judgment 
there that — you are equating them to drug purveyors or drug para- 
phernalia. I know you don’t intend do that. 

Mr. Levitin. No. No. No. Actually, I think for 

Mr. Bachus. Or online gun shops. 

Mr. Levitin [continuing]. For the purposes of what I am saying, 
I very much intend — intend that because 

Mr. Bachus. Okay. 

Mr. Levitin [continuing]. In terms of whether these are high-risk 
merchants or not, from a bank’s perspective, it doesn’t really mat- 
ter what the ultimate transaction is. It is how much risk. 

And the porn Web site and the payday lender, if they are high 
risk, they are high risk. It doesn’t — the specifics of the industry 
don’t matter. It is high risk. 

Mr. Bachus. But, you know, I think — when you are talking 
about a criminal investigation by the Justice Department, I think 
it matters whether it is a legitimate business or a fraudulent busi- 
ness. That is my point. 

Mr. Thompson, FIRREA passed in 1989. It was never used until 
now against payment processors, was it? 

Mr. Thompson. Mr. Chairman, I am not an expert on that aspect 
of FIRREA, but I believe you are correct. 

Mr. Bachus. Yeah. 

Mr. Talbott, do you know. 

Mr. Talbott. Same answer. I think that is right. 

Mr. Bachus. Okay. I think that concludes our hearing today. I 
appreciate all our witnesses. Concludes the hearing. 

Did you have another question. 

Mr. Johnson. No, sir. I do not, Mr. Chairman. 

I just want to, for the record, thank the Chairman for his willing- 
ness to have these kinds of hearings that are not so structured and 
that — it prevents us from getting down into the meat of the matter. 
And so I want to thank you for 

Mr. Bachus. Well, as you know, I am retiring after 22 years and 
I was a trial lawyer before I got here. And I don’t think I could 
have ever tried a case on a 5-minute rule or even made a point, 
and it — the structure doesn’t really lend itself. 

And not in this particular hearing, but in some hearings it 
causes the witness to filibuster by talking about anything but an- 
swering the questions. But then it also — because Members rush 
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and I — I really hate to see Members do this, but they interrupt wit- 
nesses. 

If the witness wants to give a 2-minute response, they want a 
“yes” or “no” answer. And that is not always possible. You want to 
explain yourself. 

So you get — you really don’t get a complete picture. You don’t — 
you don’t get — and then you have another witness wants to come 
in on what this witness said, which is good. 

But we — so the 5-minute rule I wish we would — would do some- 
thing about that in certain cases. But I am sure a freshman sitting 
down here wouldn’t want that. But we could always start at the 
bottom every other time. 

This concludes today’s hearing. As I said, thank you for all our 
witnesses. 

Without objection, all Members will have 5 legislative days to 
submit additional written questions for witnesses or additional ma- 
terials for the record. 

This hearing is adjourned. 

[Whereupon, at 1:18 p.m., the Subcommittee was adjourned.] 
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Chairman Bachus, Ranking Member Johnson, and members of the subcommittee, 
VBA appreciates the opportunity to submit for the record comments regarding the 
Department of Justice’s Operation Choke Point. The VBA represents all banks in 
the Commonwealth of Virginia and works collaboratively with the American 
Bankers Association on industry legislative issues. 

This Subcommittee has continually sought the input of the financial services 
industry relative to the impact of the changing regulatory scheme on individual 
institutions’ ability to serve their customers. We appreciate House Judiciary 
Committee Chairman Goodlatte’s continued outreach and ongoing efforts to bring 
commonsense to the regulatory environment. The enormous challenges facing 
banks of all sizes, especially regional and community banks, in the face of the 
regulatory overreach contained in the Dodd-Frank Act cannot be understated. 
Cumulatively, the burden placed on banks attributable to the cost and complexity 
of compliance with the avalanche of new rales, regulations, guidance and 
supervisory decrees continues to produce unintended consequences on the 
fundamental business of banking. Ultimately, Virginians- including families, 
small businesses, and farmers - bear greater costs, less access to credit and fewer 
opportunities for investment in the communities our members serve. 

Even by itself, the fallout of this regulatory' overreach in recent years is 
troublesome as tax-paying Virginia banks seek to remain key partners to help 
achieve economic growth and job creation nationally and in our Commonwealth. 
While many institutions have and will continue to adjust to these significant 
changes and continue meeting the needs of their customers, additional obstacles 
only exacerbate the challenge. That is why the Department of Justice’s initiation of 
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Operation Choke Point poses a wider concern than its individual effects, of which 
there are many. 

Virginia banks have a constructive partnership with our state and national law 
enforcement agencies, built on a mutual desire to maintain integrity and security 
within our financial systems. The safety and soundness of that system is of critical 
importance to banks, their prudential regulators and law-abiding customers. Banks 
have a tremendous amount of responsibility to combat financial crime. Through 
compliance with the Bank Secrecy Act and Anti-Money Laundering statutes, banks 
make significant personnel and technology investments to carry out their unfunded 
role in assisting law enforcement. Unfortunately, that role continues to expand with 
greater complexity as banks are saddled with increasingly burdensome risk and 
responsibility beyond the traditional balance. 

By initiating Operation Choke Point, the Department of Justice, in concert with 
some federal regulators, goes far beyond the bounds of that partnership. Pressuring 
banks to close accounts or sever services for targeted merchants deemed “high 
risk” by regulators, the Department has embarked on a disconcerting endeavor that 
undermines financial institutions’ traditional role based on questionable legal 
authority. Extracting these demands through the threat of vicarious liability for 
bank customers’ or customers’ customers’ activities, often without a court order or 
appropriate legal proceedings, is a misguided approach with serious consequences. 

As Virginia banks face mounting compliance pressures, including within 
BSA/AML responsibilities. Operation Choke Point serves to further increase the 
operating and compliance expenses associated with the risk these undue pressures 
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some banks will be forced to make the unfortunate decision, in assessing the risk 
arising from the Department of Justice’s inappropriate actions, to cease operations 
with legally licensed businesses. Law enforcement is best positioned to prosecute 
illegal behavior; forcing banks to discern and arbitrate what Justice has divined as 
their standard of conduct for legal business is not legal or effective. 

Virginia banks will continue to partner with federal and state law enforcement to 
combat financial crime. However, Operation Choke Point should not be part of that 
partnership. We encourage a prompt and definitive end to Operation Choke Point, 
so banks, regulators and law enforcement can resume a balanced approach, with 
each contributing in a maimer befitting their unique position in our financial 
system. We appreciate the attention of this subcommittee and other legislative 
bodies to this troubling initiative and support the legislative efforts to cease its 
continuation should Justice fail to terminate it of its own accord. 
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Community Financial Services Association of America 
Statement for the Record 

House of Representatives Judiciary Committee 
Subcommittee on Regulatory Reform, Commercial and Antitrust Law 

"Guilty until Proven Innocent? A Study of the Propriety & Legal Authority for the Justice 
Department’s Operation Choke" 

July 17,2014 


I. Overview 

The Community Financial Services Association of America (“CFSA") 1 appreciates the opportunity to provide 
comments on the House Judiciary Committee’s Subcommittee on Regulatory Reiorm, Commercial and Anti- 
tmst Law hearing entitled, “Guilty until Proven Innocent? A Study of the Propriety & Legal Authority for the 
Justice Department's Operation Choke Point." As CFSA lias previously stated in written testimony to the 
House Financial Services Committee both in April 2 and in July*, we have grave concerns about Operation 
Choke Point trampling on the rights of legal and legitimate businesses in many different industries. 

Operation Choke Point is a widespread federal program that has attacked countless businesses and 
industries, as well as the customers who rely on these lawful products. If Operation Choke Point is allowed to 
continue on its current path, the precedent that it is creating - that government regulators may secretly work 
to thwart lawful businesses and the customers they serve, without according them any due process rights - 
undermines the rule of law and is extremely concerning. 

II. Operation Choke Point Effects on Consumers and Industry 

While perhaps originally described as an attempt to prevent illegal bad actors from accessing the U.S. banking 
system. Operation Choke Point has gone well beyond attempting to keep fraud and criminal activity out of the 


1 CFSA was formed in 1 999 to promote laws and regulations that protect consumers while preservf ng access to credit options 

and to support ami encourage responsible practices within the payday loan Industry CFSA's member companies represent more 
than half of ail traditional payday loan storefronts across the country, in more Own 30 states. Our members provide payday loans 
to more titan 19 million households, as well as a wide range of other financial products and services, including bill payment, 
check cashing, installment loans, prepaid debit cards, and tax preparation services- CFSA members' storefront locations put us In 
the heart df many financially underserved communities CFSA members are heavily regulated at the federal level and in the indi- 
vidual states where they o potato Additionally, to serve our customers responsibly. CFSA has developed a set of 1 3 Best Practices 
that begin with compliance with nil applicable state anti federal laws They cover everything troin advertising to collection prac- 
tices Our members hold themselves to a higher standard, and we believe tint these practices differentiate uui members from 
other providers in the Short-term credit industry, 


• See CFSA statement to the House Financial Seivices Committee (April 8, 2014) available at 
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See CFSA statement to the Mouse Financial Services Committee {July IS, 2014) available at 
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banking system. Rather, it appears to be an effort to prevent payday lenders and certain other legal but 
"disfavored" businesses from having banking relationships and automated clearing house ("ACH") business 
relationships, even though these businesses are operating legally as authorized by their state charters and 
licenses and in compliance with all applicable state and federal laws and regulations, 

The Financial Fraud Enforcement Task Force (part of Department of Justice), the Federal Deposit Insurance 
Corporation ("FDIC”), the Office of the Comptroller of Currency ("OCC"), the Board of Governors of the Federal 
Reserve System ("The Board"), and potentially other regulators have been working together to pressure 
community banks and third party payment processors to reconsider use of ACH for online payday lenders. 
This unwarranted federal initiative does not distinguish between financial fraudsters and legitimate 
businesses that are operating legally. Rather, Operation Choke Point has extended its aim beyond bad actors 
and has taken aim at lawful products and services that regulators dislike or disfavor. 

Operation Choke Point has expanded quickly with no apparent regard for the serious negative effects on 
consumers' access to responsible financial credit products. For the nearly 40 million underbanked consumers 
in our country, Operation Choke Point is limiting choices among responsible financial products, particularly 
for short-term, small-dollar credit The breadth of Operation Choke Point extends throughout the nonhank 
financial services industry to numerous legitimate businesses that offer alternative consumer credit options, 
including payday loans, and has affected totally unrelated industries that regulators similarly dislike or 
disfavor. 

111. Examples of Banking Terminations 

There are numerous examples of banking institutions terminating their business relationships with dozens of 
payday lending clients, who are operating in full compliance with applicable law. Some of these banks specifi- 
cally noted their concern that working with payday lenders was receiving heightened scrutiny from the pru- 
dential regulators. In other instances, the banks specifically cited “reputational risk" and "safety and 
soundness" as the bases for termination of business relationships with payday lenders. In most cases, howev- 
er, these banks provided little to no detail or explanation regarding the reasons for the termination. Some 
banks merely stated that the decision had been made, citing no rationale for the decision or a vague reference 
to risk. 

Below are several direct examples of CFSA member companies who have been negatively affected by Opera- 
tion Choke Point In all cases, the member has suffered financial burden by having to locate new banking insti- 
tutions that provide the services it needs. In some cases, the members have not yet been able to replace these 
business relationships with banks. The following is just a sample of the statements and testimonials that CFSA 
has learned from its membership and others in the payday lending industry. Some of the examples do not 
identify the CFSA member by name out of respect for the company's understandable fear of additional ad- 
verse consequences. 

Example 1 - Advance America 

Year to date, Advance America has received terminations by nine different banks. Each bank inde- 
pendently informed the member that the service terminations were due to the result of pressure 
from its prudential regulator on the basis of reputational risk associated with the payday loan indus- 
try. The banks, Synovus Bank, Fifth Third Bank, Hancock Bank, Whitney Bank, Umpqua Bank, Capital 
One Bank, Cadence Bank, Citizens Bank, and RBS Citizens Bank had provided critical treasury man- 
agement banking services to the member. Advance America had enjoyed good, long-standing busi- 
ness relationships with all of the banks. Three of the bank relationships had been in place for well 
over a decade. 

Advance America's operations, performance and compliance programs had been more than satisfac- 
tory to these banks and the member had been in continuous communication with its banks about the 
reported heightened regulatory scrutiny of bank relationships with payday lenders. Advance Ameri- 
ca was surprised by the notices of termination since it had actually received assurances from two of 
the banks that, as one bank stated, "We were doing everything right." 


2 
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Advance America depended on treasury management banks for access to payment, deposits, and 
ACH systems and networks, payroll processing, and other commercial treasury services. The termi- 
nations of these relationships disrupted the provision of credit and other services to consumers. Ad- 
vance America believes it is clear that in accordance with Operation Choke Point, the prudential 
regulators are pressuring banks to terminate payday lenders' access to the banking system. Fur- 
thermore, it believes that regulators are not differentiating between those who operate in accord- 
ance with the law and those who do not 

Example 2 - Check Into Cash 

Creditcorp [Check Into Cash) has had a longstanding relationship with a number of large national, 
regional and community banks. Until last year, the company maintained a syndicated credit facility 
comprised of approximately six banks. It also maintained depository services, bank branch services 
and other banking services with many hanks throughout the country. 

Bank of America - Check Into Cash did business with Bank of America for 20 years and used over 250 
of their bank branches. On March 19, 2013, Bank of America informed Check Into Cash it would not 
renew its loan credit commitment when Check Into Cash's bank credit facility expired in 2015. Dur- 
ing the March 19 discussion, the Bank of America representative indicated that this was only a credit 
decision and it did not impact Check Into Cash's treasury relationship utilizing its hank branches and 
other services. Later in the year, however, Check Into Cash received a letter dated October 30, 2013 
stating that Bank of America was terminating all banking services. 

IP Morgan Chase & Co - On September 25, 2013, a representative contacted Check Into Cash stating 
that it too was terminating their banking relationship. The company received a letter dated Novem- 
ber 12, 2013 confirming the bank's decision to close their accounts. The company had conducted 
business with JP Morgan Chase for 16 years. 

Fifth Third Bank - Check Into Cash conducted business with Fifth Third for 19 years. The bank had 
been in Check Into Cash's bank credit facility. Check Into Cash banks with its branches and utilizes 
other banking services. Most recently, Fifth Third has been testing its safe recycler product in ap- 
proximately 20 of the Check Into Cash locations, with plans to expand this to other centers. The bank 
also has been promoting the recycler program as treasury solution for Check Into Cash centers and a 
significant opportunity to expand the relationship with it On March 5, 2014, Check Into Cash re- 
ceived a letter stating that Fifth Third Bank would be terminating the relationship. 

All three of these banks indicated that the reason for closing the accounts was tied to payday lending. 
Since the company provides various other financial services such as short term installment loans, ti- 
tle loans, check cashing etc., it asked if subsidiaries offering loans and services other than payday 
loans could continue to do business with the banks. 

Example 3 - Cash Tyme 

Cash Tyme operates in seven states, with approximately 50 storefront locations. The products it of- 
fers include payday advance loans and check cashing. Its banking relationships have been terminated 
by three different banking institutions in 2014 and has clearly suffered financial burden by trying to 
relocate to new banking institutions. 

Capital One - Cash Tyme recently received a termination notice from Capital One Bank, in which the 
bank stated that it was terminating all deposit and treasury services with the company. The Capital 
One letter stated that the bank had "made the decision to exit the business of providing commercial 
banking services to check cashers and related businesses." 


Fifth Third Bank - Cash Tyme had over a decade of business relationships which accounted for ap- 
proximately $250,000 a year. It received a termination letter from Fifth Third earlier this year that 
stated that "services provided by clients in this industry are outside of our risk tolerance.” This ter- 
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mination affected nearly 30 bank accounts. The member has not been provided additional infor- 
mation or a further rationale for the termination. 

Wells Fargo - Cash Tyme had a long-time business relationship with Wells Fargo. It received termina- 
tion letters from the bank earlier this year that terminated three different accounts, both deposit ac- 
counts and treasury management (ACH origination) services of those accounts. In a letter, the bank’s 
explanation for termination was, "Wells Fargo performs ongoing reviews of its account relationships 
in connection with the Bank's responsibilities to oversee its banking operations. After careful review, 
a business decision has been made to close your account(s) referenced above and terminate all relat- 
ed Treasury Management services (e.g. ACH origination services) associated with the above ac- 
counts." 

Example 4 - Speedy Cash. Inc. (Lending Bear) 

Bank of America - Speedy Cash, Inc. was given verbal notification several months ago that Bank of 
America was "exiting the payday advance business," and would be closing its nine business checking 
accounts sometime in the next three to six months. Speedy Cash, Inc, finally received a written letter 
regarding the termination in late June, in which Bank of America stated it was closing all small busi- 
ness accounts with the company "based on the nature of your business and associated risks." The 
company has had difficulty finding another bank to take over these accounts. 

Example 5 - Xpress Cash Management 

Fifth Third Bank - Xpress Cash Management received a written termination notice from Fifth Third 
stating that the payday loan industry was "outside [its] risk tolerance." 

Example 6 - CFSA Member Company A 

The CFSA member company operates in 28 states, with over 1200 storefront locations. Among the 
products offered are payday advances, check cashing, installment loans, and title loans. The company 
had banking services terminated by four different banking institutions since December 2013 with 
very little reason provided. 

BBVA Compass Bancshares - The bank terminated its relationship in December 2013. The company 
was told by the bank that they are no longer servicing the payday lending industry, providing no oth- 
er specific reasons. This affected retail storefront accounts. 

Bank of America - The bank terminated its relationship in December 2013, The company was told by 
the bank that it was ceasing to do business with the industry to avoid reputational risk and compli- 
ance issues, but it provided no more specific reasons. This affected retail storefront accounts. 

IP Morgan Chase and Co - The bank terminated its relationship in February 2014. The CFSA member 
was told hy the bank that it was ceasing to do business with the industry to avoid reputational risk 
and compliance issues, but provided no more specific reasons. This affected retail storefront ac- 
counts. 

Fifth Third Bank - The bank terminated its relationship in March 2014. The CFSA member was told 
by the bank that it was ceasing to do business with the industry to avoid reputational risk and com- 
pliance issues. The termination affected corporate accounts, retail storefront accounts, centralized 
returns, and the company's ACH processor. 

Bank of California/ORCC - In September 2013, the company was informed by its card processing 
company that it could not continue to service payday lenders due to the unwillingness of its bank. 


Exampl e 7 - C FSA Member Company B 

The CFSA member company is a lender for over 750 storefront locations. It has had two different 
banks terminate business relationships due to Operation Choke Point 
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PNC Bank - The CFSA member has had 18 accounts terminated, with no specific reason provided for 
the termination. The bank just indicated that it was industry-related; no letter was provided. 

Huntington Bank - The CFSA member has had 38 accounts terminated, with no specific reason pro- 
vided for the termination. The bank just indicated that it was industry -related; no letter was provid- 
ed. The company was only given 30 days' notice before the termination became effective. 

Example 8 - CFSA Member Company C 

Bank of America - The CFSA member lost its clearing and currency funding banking relationship with 
Bank of America. This covered 90 percent of its U.S. store network. The member's relationship with 
Bank of America originated with the founding of the company in the late 1990s. The member was 
given no advance notice, and the letter it received provided 90 days-notice. 

Example 9 - CFSA Member Company D 

Bank of America - In late November 2013, Bank of America notified this member that it would cease 
to conduct business with any payday lenders as of December 31, 2013. Since January, Bank of Ameri- 
ca has closed the company's accounts and they are currently operating without local banking because 
they have been refused service by several financial institutions 

Example 10 - CFSA Member Company E 

Bank of America - The CFSA Member had a long standing relationship with Bank of America, which 
was recently terminated. The member was told by Bank of America that it was no longer going to 
work with payday lenders because of compliance concerns. This member primarily offers installment 
loans and title loans, a fact that was shared with Bank of America. Bank of America still insisted on 
ending the banking relationship. Furthermore, it also closed an operating account with a manage- 
ment entity that does not, and never has, offered any loan products. 

Example 1 1 - CFSA Member Company F 

Huntington National Bank - The CFSA member company received a termination notice in May 2013. 
The member was told by the bank that they could not, "farther discuss why Huntington has chosen to 
dissolve all banking relationships with payday lenders." However, the CFSA member believes it was 
related to Operation Choke Point. 

IV. Conclusion 

CFSA is extremely concerned about the adverse consumer and business impacts of Operation Choke Point. 

Our views are the same as many other organizations that serve the members of the industries that have been 
targeted: Operation Choke Point adversely affects the rights of legal and legitimate businesses through un- 
warranted and unjustified actions of federal agencies. 

Operation Choke Point sets an extremely dangerous precedent if the federal government is permitted to be 
the moral arbiter of which industries deserve to be in business. It is imperative for the government to make 
every effort to differentiate fraudulent actors from legitimate, law-ahiding businesses. Agencies of the federal 
government should not be permitted to take regulatory or supervisory action outside the letter and spirit of 
the laws passed by the Congress, and the banking system should not be used to deny lawful businesses due 
process and to favor certain industries, while punishing others. 

We respectfully ask that Congress and this Committee take appropriate action to put an end to Operation 
Choke Point 
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Jul) 17.2014 

Operation Choke Point A Threat to Free 
Commerce and the Rule of Law 

On behalf of the more than 6.500 community banks represented by the Independent Community 
Bankers of America, thank you for convening today's hearing on the Department of Justice's 
Operation Choke Point We welcome this opportunity to submit ICBA s statement for the record 

Operation Choke Point is a DOJ initiative intended to address consumer fraud by “choking off 
access to fraudsters' banking services Community banks currently dedicate significant energy 
and resources to monitoring, detection and reporting of fraud and other financial crimes in 
compliance with the Bank Secrecy Act Last year alone, depository institutions filed over 
600,000 suspicious activity reports to assist federal and local law enforcement in the fight against 
financial crime. Community banks are eager to cooperate with low enforcement but cannot and 
should not act as police 

In the last two years. Choke Point has targeted more than 50 banks and payment processors with 
subpoenas issued under a very aggressive reading of its authority under the Financial Institutions 
Reform. Recovery, and Enforcement Act (FIRREA) Reputation in their communities is the 
stock-in-trade of community banks The mere prospect of enforcement action is daunting enough 
to lead risk adverse community banks to shut off access to their payment systems to all but the 
most established, low risk businesses 

All legal forms of business should be allowed to operate freely with access to essential banking 
services, subject to the discretion of banks, and without excessive pressure or intimidation from 
law enforcement Law enforcement should focus on criminals directly, without forcing banks to 
act as police, and their efforts should be narrowly targeted ICBA is encouraged that members of 
C ongress on both sides of the aisle have been critical of the aggressive tactics and troubling 
impact of Operation Choke Point 

At the same lime, bank regulators have begun applying unwarranted scrutiny to bank 
relationships with categories of businesses deemed “high risk" or that supposedly create 
“reputational risk ‘ These businesses include iniemei-based businesses, short term tenders, 
telemarketers, debt collectors, and other lawful businesses Regulators have questioned long- 
standing relationships with businesses that have been properly screened by the bank’s own risk 
controls It is beyond the scope of the supervisory process to assess a bank's reputational risk or 
to prohibit or discourage community banks from providing these services Community banks are 
the best judge of their own reputation risk and have every incentive to safeguard their own 
reputations through proper screening of customers They conduct due diligence to assess the 
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level of risk of each customer relationship and ensure that controls arc in place to identify and 
monitor these relationships on an ongoing basis 

The End Operation Choke Point Act of 2014 (H.R. 4986) 

ICBA supports legislation that is currently pending in the Financial Services Committee that 
would preserve the ability of banks to serv e legal and legitimate business customers without 
undue pressure from law enforcement or examiners 

The End Operation Choke Point Act of 2014 (II R 4986), introduced by Rep Blaine Luetkemeyer (R- 
MO). would clarify responsibilities of cooperation between banks and law enforcement in cases of 
financial fraud It would promote direct prosecution of fraudsters and preserve access to banking 
services for legal businesses In addition, the bill would rein in DOJ ’s abusive use of subpoena 
authority and create a safe harbor for banks serving businesses that meet specific criteria 

Thank you again for the opportunity to provide this written statement for the record 


One Mission Community Banks. 
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HEARING: GUILTY UNTIL PROVEN INNOCENT? A STUDY 
OF THE PROPRIETY & LEGAL AUTHORITY FOR THE 
JUSTICE DEPARTMENT’S OPERATION CHOKE POINT 

U.S. HOUSE OF REPRESENTATIVES 
COMMITTEE ON JUDICIARY 

SUBCOMITTEE ON REGULATORY REFORM, COMMERCIAL 
AND ANTITRUST LAW 

July 17, 2014 


Dear Chairman and Ranking Member: 

My name is Marsha Jones, and I am the President of the Third Party Payment 
Processors Association (TPPPA). I am pleased to provide testimony on behalf of the 
organization and the industry. 

Third-party payment processing is an integral part of the payments industry and the 
economy as a whole. Payment processors are the technology innovators that 
provide consumers faster and easier ways to make payments, and provide small and 
mid-sized businesses an opportunity to collect and make payments electronically. 
This enables them to compete more effectively in a global marketplace with their 
larger competitors. Third party payment processors also provide direct deposit of 
payroll, providing consumers with safe and immediate access to their paycheck. 

A third party payment processor (TPPP) is a depository customer of a bank that 
processes payments on behalf of other companies (merchants) through the TPPP's 
banking relationship. The role of the TPPP is to provide merchants with access to 
the electronic payments system, so that the merchants' customers have the ability to 
make electronic payments to the merchant and the merchant can make electronic 
payments to employees (direct deposit of payroll) and their business partners 
(business-to-business payments.) Third party payment processors typically have 
hundreds of customers that they process for including, mom-and-pop grocery 
stores, day-care centers, homeowner associations and more. They also provide 
access to, and payment and technical support for tens of thousands of merchants for 
which payment processing directly through a bank would be cost prohibitive. 
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The most vulnerable of small businesses rely on third party payment processors to 
enable them to participate in electronic payments, as they may not meet the 
standards to set up direct payment processing services through a bank directly. For 
example, they may be too small to qualify to process payments through a bank, they 
are too new, or they are struggling to turn their company around and no longer 
meet the credit requirements of a bank to process payments. This category has 
grown significantly since the financial crisis. These are the primary business 
beneficiaries of third party payment processing. 

Consumers rely upon third party payment processors for virtually all direct deposit 
of payroll, most innovative mobile payment solutions and many of the bills and 
online purchases that they make. Third party payment processors provide 
consumers with more electronic payment choices than credit cards. These 
expanded choices have become increasingly more important as consumers' access 
to credit has decreased, providing the opportunity for some vulnerable consumers, 
without access to credit cards, to continue to make electronic payments. 

Like other financial institutions, third party payment processors seek a diverse 
portfolio of customers to help manage risk. If a payment processor elects to process 
for higher-risk merchants, the typical payment processor diversifies their payments 
portfolio with some higher risk and low risk transactions. This protects the 
processor and the bank from credit risk. However, the processor still has 
contractual and regulatory due diligence obligations that it has to meet with regards 
to these high risk merchants. 

This third party role has become the subject of significant scrutiny by banking 
regulators and by the Justice Department, and appears to be the genesis of 
Operation Choke Point. Unfortunately, however, what appears to have started as a 
legitimate interest in targeting a few companies who may have facilitated fraudulent 
transactions has morphed into a significant attack on the whole industry. The 
impact of Operation Choke Point has been significant not only on the third party 
payment processors, and on the targeted, high-risk, and lawful industries that it 
seeks to disrupt, but also on the low-risk merchants that our members serve, as well 
as the consumers that benefit from the payment services. 

Operation Choke Point is designed to sever the flow of funds to target merchants by 
separating either the processor or merchant from the banking system. However, 
when a processor is shut off from the banking system, ALL of their merchants are 
disrupted, including those for small businesses and direct deposit of payroll for 
consumers, resulting in harm to the economy and harm to consumers. 

The strategy of Operation Choke Point causes severe collateral damage. Targeting a 
merchant by going after a payment processor that processes a wide variety of 
payments to businesses of all types as well as consumer payroll has far-reaching and 
devastating impact. 
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The Third Party Payment Processors Association is fully supportive of prosecuting 
merchants or processors who engage in or perpetuate fraud against consumers. 
However, we strongly believe Operation Choke Point has resulted in casting too 
wide a net and is an irresponsible and ineffective strategy. 

The TPPPA recognizes that we have a responsibility to help our bank and processor 
members, and merchants they serve, to comply with the applicable laws and 
regulations. As such, we are voluntarily creating an industry best practices system 
as a means of self-regulating the third party payment processing industry. This 
Compliance Management System (CMS) will help enable banks and third party 
payment processors, as well as merchants to comply with the laws and regulation 
and ensure that proper due diligence is performed throughout the third payment 
processing system. We believe that this is the most responsible and effective way to 
impact change without disrupting innovation, hurting small businesses and robbing 
consumers of effective and innovative ways of making and receiving payments. 

We thank the House Judiciary Committee for holding this important hearing and for 
the opportunity to present our written testimony. 


"The hallmark of the TPPPA is promoting compliance as the road to achieve payments 
integrity and excellence." Marsha Jones, President, Third Party Payment Processors 
Association (TPPPA) 
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THIRD PARTY PAYMENT PROCESSOR ASSOCIATION 

(TPPPA) 

The TPPPA is a national not-for-profit industry association representing and 
promoting the interests of payment and payroll processors, their financial 
institutions and their merchants. The TPPPA formed in the summer of 2013 to raise 
awareness of the unintended consequences of Operation Choke Point and to create 
industry best practices in compliance for third party payment processing. 

The TPPPA was formed to address the unmet needs of payment processors and 
their financial institutions that primarily process Automated Clearing House (ACH) 
and remotely created checks (RCC) payments. 

TPPPA Leadership 

• President 
Marsha Jones, AAP, NCP 

• Board of Directors 
Intercept (Fargo, ND) 

Repay (Atlanta, GA) 

ACHWorks (Gold River, CA) 

EFT Network (Hawthorne, NY) 

Secure Payments Systems (San Diego, CA) 

President’s Bio 

• Accredited ACH Professional (AAP) 

• National Check Professional (NCP) 

• 6 years at Viewpointe Regional Payments Association (NACHA) 

Member of NACHA’s Risk Management & Advisory Group 
Created and Facilitated Third-Party Sender Roundtable 
Designed ACH Originator Compliance Self Assessment 

• 7 years at Capitol Bancorp Ltd 

Responsible for all payments processing for 50+ Community Banks 

• 7 years at Wells Fargo Bank 

Operations Manager Small Business Lending Renewal Team 



202 


Our Mission 

In service of our members and the payments industry our mission is to provide: 

• Advocacy 
4 Leadership 
4 Support 

Advocacy 

TPPPA advocates on behalf of its members as to the vital role processors play 
in our economy. Promoting and representing the interests of our members, 
and forging productive relationships with: 

• Members of Congress 

• Regulators 

• Rule-Making Bodies (NACHA, ECCHO) 

• Other trade associations, (ABA, ICBA, ETA, Regional Payment 
Associations) 

Leadership 

TPPPA provides leadership in the industry by working with stakeholders to 
explore opportunities and examine solutions to innovate in a compliant 
manner. 


• Create industry best practices through our Compliance 
Management System. 

4 Engage members and industry stakeholders in the payments 
rulemaking. 


Support 

All TPPPA members receive exclusive and ongoing training, guidance and 
compliance support. 

4 Processor and Financial Institution members receive the 
Compliance Management System (CMS) as part of their 
membership at no additional cost. 

• TPPPA supports other trade associations in their payments 
compliance efforts. 
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Code of Conduct 

The Third Party Payment Processors Association is a not-for profit trade 
association responsible for providing advocacy, support and industry leadership to 
its members. The Association has adopted a Code of Conduct to ensure the 
activities that affect the payments industry and its members are conducted with 
the highest levels of integrity, professionalism and fairness. Ail active members of 
the Association will subscribe to the following Code of Conduct: 

1. Adhere to the spirit as well as the letter of all applicable regulations, rules 
and laws related to the payments it processes, 

2. Avoid even the appearance of professional misconduct or criminal offense. 

3. Conduct business in a manner that does not adversely impact the 
membership or the payments industry. 

4. Conduct all activities in a professional and businesslike manner. 

5. Remain current on financial obligations to Association. 

6. Respect the privacy and confidentiality of the membership and member 
business. 

The Association reserves the right to disassociate itself from any organization that, 
in its opinion, fails to abide by our Code of Conduct. 

Members Categories: 

• Members (Voting and Non-Voting) 

• Payment Processors 

• Payroll Processors 

• Financial Institutions 

• Affiliate Members (Non-Voting) 

• Merchants 

• Vendors 

• Other Associations 

• Other Industry Stakeholders 
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The TPPPA Compliance Management System 

Policies that are tailored to the unique needs and responsibilities of TPPPA 
members: 

Payment and Payroll Processors 
Financial Institutions 

Created to address the oversight of relevant regulatory agencies, including FDIC, 
OCC, FRB, CFPB and FinCEN 

Processor Module 

Written for payment and payroll processors policies incorporate guidance 
for: 

Due diligence and enhanced due diligence 
Ongoing monitoring, management and review 
Detecting and reporting suspicious activity 

Policies include: 

BSA/AML/OFAC 
Consumer Complaints 
UDAAP 

Information Security, Privacy, Red Flags 
High Risk Verticals 

Telemarketing, Debt Collections, Lending 
And more 

Financial Institution Module 

Written for FIs with processors as customers. Helps incorporate existing 
policies of the financial institution into a cohesive program for third party 
payment processing. 

Both Modules Address 


Risk Assessment (Due Diligence and Underwriting) 

Agreements 

Merchant Training 

Ongoing Monitoring 

Periodic Review 

Escalation and Reporting Suspicious Activity 
Termination of Merchant Relationships 
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Regulator Interaction and Relationships 

The TPPPA has conducted meetings with the following regulators to introduce 
them to the TPPPA and to socialize our Compliance Management System 
methodology: 

Commission of State Bank Supervisors (CSBS) 

Consumer Financial Protection Bureau (CFPB) 

Federal Trade Commission (FTC) 

Federal Depository Insurance Corporation (FDIC) 

Office of the Comptroller of the Currency (OCC) 

Federal Reserve Bank (FRB) 

These meetings were productive and the following objectives were met: 

• Introduced the association, our mission, purpose and immediate 
objectives 

• Created an open dialog with regulatory agencies 

• Created framework for sharing the TPPPA's CMS and receiving feedback 

TPPPA’s Commitment to the CMS 

The TPPPA is committed to reviewing and updating the CMS on an ongoing basis 
to ensure alignment with changes to regulation, regulatory guidance and 
payment system rule changes. We are committed to continual improvement of 
the policy set and will add new policies as needed. For example, a policy for 
Remotely Created Checks and a policy for Managing Cross Channel is slated for 
the 2015 release. We are also committed to vetting the CMS with regulators and 
rule making bodies on an ongoing basis. The TPPPA will provide regulators with 
an initial copy of the CMS by August, 2104. 

CMS Certification for Payment Processors 

The TPPPA is in the process of developing control framework for a voluntary 
SSAE16 Certification Audit with an independent audit firm. Successful 
completion of a SOC1 audit in year one and SOC2 thereafter, will make processor 
eligible for certification by the association. The TPPPA CMS Certification Audit is 
estimated to be available in September 2014. 

CMS Consulting and Training 

The TPPPA provides consulting and training to assist members in integrating the 
CMS policies into their payments practices. We recognize policies alone do not 
make a difference unless they are used to align practices, processes and 
procedures with CMS policies, and have the policies drive the company culture 
and behavior. Ongoing training and support will be made available to the 
members to support the association’s compliance objectives. 
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Contact Us: 

Third Party Payments Processors Association (TPPPA) 

20 F Street NW, 7th Floor 

Washington, DC 20001 

wtvw.tpppa.org 

Marsha Jones, AAP, NCP 

President 

(602) 402-0416 - Cell 

mjones@tpppa.org 
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Questions for the Record from 
Chairman Bachus 
for the Oversight Hearing on 

“Guilty Until Proven Innocent? A Study of the Propriety & Legal Authority for the Justice 
Department’s Operation Choke Point” 

July 17, 2014 

Questions for the Honorable Stuart F. Delerv 


1 . The Committee has received numerous reports of widespread client tenninations within 
specific industries as a result of Operation Choke Point. Whether or not it was DOJ’s 
intention, do you deny that it is happening? 

2. ZestFinance is an online lending startup founded by a Princeton graduate who is the former 
Chief Information Officer at Google. It uses mathematical analysis of large consumer data 
sets to offer loans at a “far lower” cost than competing products. ZestFinance submitted a 
statement to the Committee that, as a result of Operation Choke Point, they have already had 
to lay off 45% of their workforce. Were you aware that this has been happening? 

a. If yes, how specifically has the Division responded? Has it met with company 
representatives or taken any corrective action, either in this case or more broadly? 

b. If not, are you worried about what similar cases you might be missing where 
Operation Choke Point is destroying innovation, killing jobs and harming the very 
people it is supposed to be helping? 

c. What specifically will the Division do to avoid further collateral damage of this kind? 

3. The Comptroller of the Currency has lamented a trend toward “de-risking,” the practice of 
“simply abandoning customers in higher risk categories because a lack of resources makes it 
difficult to manage the risk.” Whether or not DOJ intended de-risking to occur as a result of 
Operation Choke Point, it seems clear that it is happening now. Accordingly, do you agree 
that DOJ can no longer claim this consequence i s unintended if it allows Operation Choke 
Point to continue without changes? If so, what specific changes are you pursuing to avoid 
and reverse unnecessary de-risking? 

4. In your testimony, you reference a 30% return rate as an indicator of fraud. At the hearing, a 
copy was produced of an Operation Choke Point subpoena demanding extensive records of 
processors & merchants with just a 3% return rate. DOJ has sent more than 50 subpoenas. 
What percentage of them demand information based on a 3% return rate or other rate lower 
than the 30% rate? 

5. How precisely was that 3% benchmark developed? What was the financial expertise of those 
who developed it? 

6. A memo to you about Operation Choke Point noted that DOJ may be “filing civil complaints 
or criminal cases against banks based on transactions with fraudulent merchants and/or 
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processors — but not filing actions against the underlying fraudulent merchants or 
processors.” How many lawsuits have you filed as a result of Operation Choke Point against 
the “underlying fraudulent merchants or processors”? 

7. What alternatives to Operation Choke Point, better tailored to address fraud and avoid 
collateral damage, have you considered, or are you considering? For example, have you 
considered or are you considering establishing, safe harbors to facilitate cooperation with 
regulators, such as a safe harbor that would allow payments companies, which were not 
directly involved in the fraudulent activities of a merchant, to work with regulators without 
unnecessarily triggering an enforcement action. 

8. At the hearing, we heard testimony that Operation Choke Point is merely enforcing long 
standing “know your customer” obligations under the Bank Secrecy Act. If so, why isn’t the 
Financial Fraud Enforcement Task Force pursuing these cases under that statute and its 
implementing regulations instead of FIRREA? 

9. Does federal law prohibit banks and other lenders from offering unsecured consumer loans 
with APRs that exceed 36% to consumers other than uniformed military personnel? 


Questions from Subcommittee Ranking Member Henry C. “Hank” Johnson, Jr. 

10, On June 26, 2014, Rep Luetkemeyer introduced H R, 4986, the “End Operation Choke Point 
Act of 2014.” How would this legislation affect the Civil Division’s ability to investigate 
and prosecute unlawful activity and fraud on consumers 9 
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Questions for the Record from 
Chairman Bachus 
for the Oversight Hearing on 

“Guilty Until Proven Innocent? A Study of the Propriety & Legal Authority for the Justice 
Department’s Operation Choke Point” 

July 17, 2014 

Questions for Adam Levitin 


1 . Your legal analysis of DOJ’s FIRREA authority hinges on the involvement of the Automated 
Clearing House (ACH) system and its associated warranties and participation rules. Do you 
believe that the same analysis applies to the large number of non-ACH transactions also at 
issue in Operation Choke Point? 

Questions from Subcommittee Ranking Member Henry C. “Hank” Johnson, Jr. 

2. Under the Bush Administration, the Office of the Comptroller of the Currency, which plays 
an important role in the oversight and regulation of the financial system, issued guidance on 
several occasions noting the high-risk profile of third-party processors. Do you agree that 
this guidance issued under the Bush Administration demonstrates that the disparate treatment 
of lenders under state law and the opaque relationships of third-party processors continues to 
justify heightened monitoring and diligence requirements for banks transacting with high-risk 
merchants, such as lenders? 

3. Do you believe that the guidance issued by financial regulators under the Bush 
Administration was a backdoor attempt to shut-down or “choke off’ industries it did not 
agree approve of? 

4. Has any guidance from financial regulators on high-risk merchants and payment processors 
departed substantially from the Bush-era guidance under the Obama Administration? 

5. There is some concern that even if the Justice Department’s investigations of unlawful 
activity is warranted, the mere act of sending administrative subpoenas to banks — or in the 
case of financial regulators, reminding banks of their anti-money laundering requirements — 
has caused unintended consequences resulting in banks no longer transacting with certain 
merchants in high-risk industries. Has this risk always existed in this industries, or has it 
risen substantially over the past several years as a part of the efforts of the Justice 
Department and financial regulators? 

6. Jane Larimer, the general counsel of NACHA, has noted that allowing third parties to 
directly access the ACH Network exposes both financial institutions and the network “to a 
variety of risks, including frauds that arise out of shortcomings in the originators or third 
parties policies and procedures.” As Larimer notes, when banks “abdicate all responsibility 
for risk management and they abdicate that due diligence responsibility, that definitely could 
add risk to the network.” Was Four Oaks Bank one such example of a bank abdicating 
responsibility by allowing a processor to directly access the ACH Network on behalf of 
merchants despite overwhelming evidence of fraud and potentially unlawful actions? 
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Questions for the Record from 
Ranking Member Henry C. “Hank: Johnson, Jr. 
for the Oversight Hearing on 

“Guilty Until Proven Innocent? A Study of the Propriety & Legal Authority for the Justice 
Department’s Operation Choke Point” 

July 17, 2014 

Questions for Scott Talbott 


1 . Did the Justice Department provide an opportunity for the Electronic Transaction 
Association to meet with Assistant Attorney General Delery to express concerns associated 
with Operation Choke Point? 

ETA did meet with Assistant Attorney General Delery to discuss Operation Choke Point 
and its concerns about the adverse consequences it could have on payment processors, 
merchants and consumers. ETA also requested that the DOJ cooperate with payment 
processors to combat fraud, rather than adopt an adversarial approach through 
Operation Choke Point, ETA believes that a cooperative approach would be a more 
e ffective approach for preventing fraud while minimizing adverse consequences to law- 
abiding payment processors, merchants and consumers. 

2. In your written testimony, you note the Electronic Transaction Association strongly supports 
keeping fraud off the ACH Network through existing laws and regulations. F1RREA is an 
existing law, correct? 

FIRRE4 is an existing law. ETA strongly supports using the proper authorities to combat 
fraud, but ETA is concerned about DOJ's use of FIIIREA to pursue payment processors 
that were not committing fraud and holding them liable for fraud committed by third 
parties. 

3. Courts have upheld the Justice Department’s use of FIRREA to enforce existing laws and 
regulations to keep fraud off the ACH Network, correct? 

The case law on the applicability of FIRREA (12 U.S.C. § 1833a) with regards to 
payment processors is very limited. In particular, no appellate court has yet to rule on 
the scope of liability of payment processors under 12 U.S.C. § 1833a. 

4. Are there high-risks associated with certain merchants and third-party processors? 

Some merchants may pose higher risks to consumers and the payment system based on 
the products they sell, their methods of sale, their location, and other risk factors. 
Nonetheless, these merchants may operate lawful businesses and engage in law fid sales 
practices. Payment processors already follow policies and procedures to evaluate and 
monitor these types of merchants to help mitigate risk and ensure that processors do not 
provide services to unlawful businesses. ETA has led. efforts to further strengthen the 
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industry 's due diligence and risk management practices through the development and 
promotion of its Guidelines on Merchant and ISO Underwriting and Risk Monitoring. 

( See answer to question 5 for more information on the /', I A Guidelines). It is important 
to remember that ETA members bear the costs of fraudulent transactions and so have a 
strong incentive to keep fraudulent merchants off the payment system. 

5. What are the Electronic Transaction Association Guidelines ? 

Ihe ETA Guidelines on Merchant and ISO Underwriting and Risk Monitoring provide 
tools and strategies to ETA members for the underwriting and risk management of 
merchants and the due diligence and oversight of independent sales organizations (ISOs) 
and other third parties. When used in conjunction with the rules set in place by existing 
payment networks, applicable laws and regulations, and the requirements of acquiring 
banks, the ETA Guidelines are intended to help prohibit unlawful merchants from 
entering into or remaining in the payment system. 

6. On page 57, ETA’s Guidelines discuss merchants requiring enhanced due diligence, 
including high-risk merchants. Which merchants are included in this category? 

The ETA Guidelines identify factors that payment processors can use to evaluate whether 
a merchant is likely to pose a higher risk of loss to the payment system or harm to 
consumers, including (among oilier things) processing performance of the merchant 
measured by sales volume, return transaction, and chargebacks: types of products sold; 
methods of sale; marketing tactics used by merchants; merchant locations; and newly 
identified fraud trends. The Guidelines pay special attention, for example, to e- 
commerce merchants, merchants that promote " free ” and “.free trial'' offers, merchants 
engaged in membership clubs or continuity billing programs, telemarketing merchants, 
and merchants that use affiliate marketing. Section 3 of the ETA Guidelines (pages 19- 
29) provides a discussion of these mere hauls. 

7. Do ETA’s Guidelines also assume that there are high risks associated with certain merchants 
and third-party processors? 

The ETA Guidelines recognize that certain types of merchants may pose higher risk of 
loss to the payment system or harm to consumers. The ETA Guidelines focus on 
providing tools and strategies to evaluate these merchants and help the payment 
processor determine whether to provide services to these merchants. Section 6 of the ETA 
Guidelines also provide tools for ETA members that sponsor independent sales 
organizations (ISOs) and other third parlies in reviewing and evaluating the practices of 
third party processors and their merchant portfolios. Consistent with recent guidance 
published by the Office of the Comptroller of the Currency, the Guidelines outline a 
number of risk considerations applicable to using third parlies, including operational 
risk, compliance risk, credit risk, legal risk, strategic risk, reputation risk, and risks 
associated with the concentration of resources. 
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8. On page 58, ETA’s Guidelines discuss reputation monitoring. What do ETA’s Guidelines 
require of ETA’s member organizations when “investigating merchants, particularly those 
representing potential higher risk due to marketing or sales methods, product type, or 
operational issues”? 

The introduction to the ETA Guidelines emphasizes that ETA members should use the 
Guidelines to prevent fraudulent merchants from entering into or remaining in the card 
acceptance ecosystem. With respect to merchant investigations, the ETA Guidelines 
advise ETA members to investigate fully, notate the merchant file completely, and take 
action concretely. The ETA member ’s action in response to an investigation will depend 
on the results o f the investigation and may range from requiring the merchant to take 
corrective action within a specified lime period to closing the merchant account. The 
ETA Guidelines clearly stress that increasing merchant reserves or charging higher fees 
to merchants should not be used as alternatives to requiring corrective action or closing 
accounts that pose unacceptable risk. 
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Questions for the Record from 
Ranking Member Henry C. “Hank: Johnson, Jr. 
for the Oversight Hearing on 

“Guilty Until Proven Innocent? A Study of the Propriety & Legal Authority for the Justice 
Department’s Operation Choke Point” 

July 17, 2014 

Questions for David Thompson 


1 . Setting aside any concerns that one might have with the usurious rates for borrowers of short- 
term loans, do you agree that unlawful lenders, or lenders operating in states without a 
license, are poor ambassadors of the short-term lending industry? 

2. Do you agree that as unlawful activity, illegal lending in violation of state law should be 
investigated and prosecuted by state attorneys general, and where appropriate, the Justice 
Department? 

3. Many of your members are engaged in services beyond payday lending, including money 
transmitting, correct? 

4. Following revelations that terrorists utilized the U.S. financial system to launder money to 
finance the 9/1 1 attacks, the United States has worked to tighten controls over money 
laundering. Moreover, recent findings that banks like HSBC and BNP Paribas have been 
involved in unlawfully transmitting money to drug cartels, terrorists, and countries like Cuba 
and Iran in violation of U.S. sanctions, have heightened concerns about compliance with anti- 
money laundering rules. Do you think that it is inappropriate for a bank to avoid providing 
services to companies engaged in money transmitting if the bank either prefers to avoid that 
line of business or does not have confidence in the controls of a particular company? 

5. In the only complaint filed by the Justice Department as a result of the Operation Choke 
Point investigations, did the Justice Department specifically target online lenders, or did the 
complaint more broadly apply to other unlawful activity, like Ponzi schemes and unlawful 
gambling? 

6. In the Four Oaks Complaint, the Justice Department argued in paragraph 46, footnote five, 
that in addition to defrauding consumers, at least one of the online lenders that directly 
transacted with the ACH network through Four Oaks Bank was located in Georgia, a state 
where payday lending is strictly prohibited. Should this lender have been allowed to directly 
access the ACH Network through a bank in violation of Georgia’s laws? 

7. In its complaint against Four Oaks Bank, the Justice Department alleged that the bank 
provided payday lenders with direct access to consumers’ bank accounts and the ACH 
Network. Upon further inquiry. Four Oaks Bank learned that Payday Lender 16 was owned 
by a resident of the United Kingdom. Four Oaks Bank also learned that Payday Lender 16 
did not have a United States presence except for a mail-drop at a “virtual office” space. In 
April 201 2, Four Oaks Bank concluded that Payday Lender 1 6 “appears to be a US company 
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in name only.” Four Oaks Bank nevertheless provided Payday Lender 16 access to the ACFI 
network, resulting later in 2012 in an astoundingly high return rate of 70.02 percent. Don’t 
you agree that allowing merchants like Payday Lender 16 direct access to consumers’ 
accounts is problematic, should be investigated, and prosecuted where unlawful activity is 
found? 

8. Professor Levitin has argued that many of the harms complained of by high-risk merchants 
have occurred for more than a decade as a result of uniform treatment by financial regulators 
under both Republican and Democratic Administrations. Flow do you respond to this 
argument? 

9. In your written testimony, you argue that financial regulation is arbitrary and capricious in 
violation of the Administrative Procedure Act. To which guidance are you specifically 
referring? 

10. Under the Bush Administration, the Office of the Comptroller of the Currency, which plays 
an important role in the oversight and regulation of the financial system, issued guidance on 
several occasions noting the high-risk profile of third-party processors. For instance, in 
2001, the OCC noted that banks need to understand the market and customer base of third- 
party processors whose “activities often involve significant reputation, strategic, transaction, 
and compliance risk to the bank.” In 2001, the OCC also instructed national banks to be 
mindful of third parties seeking to avoid state laws that would otherwise apply to their 
activities lending laws, and to “take special care to avoid violating fair lending and consumer 
protection laws and regulations, particularly when the actual involvement of the bank and the 
third party may be invisible to the customer.” How is this guidance any different than 
guidance by financial regulators under the Obama Administration? 

11. Did the CFSA or other short-term lenders object to this guidance under the Bush 
Administration, or formally request a rulemaking under section 553 of the Administrative 
Procedure Act? 

12. You also argue in your written testimony that short-term creditors are “an easy first target” 
for the DOJ’s campaign against merchants disfavored by the current administration. Do you 
believe that the guidance issued by financial regulators under the Bush Administration was a 
backdoor attempt to shut-down or “choke off’ industries it did not agree approve of? 

13. Section 951 of Financial Institutions Reform, Recovery, and Enforcement Act, also known as 
FIRREA, authorizes the Attorney General to investigate and bring a civil action seeking civil 
penalties for substantive violations of, or conspiracies to violate, various criminal offenses, 
including wire fraud, that affects a federally insured financial institution. How does guidance 
by financial regulators have any relationship to the Justice Department’s investigation of 
high-risk merchants under FIRREA? 

14. Did the Justice Department use this or similar guidance from financial regulators as a legal 
basis for its complaint against Four Oaks Bank 9 
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15. Did the Justice Department use this or similar guidance from financial regulators as a legal 
basis for subpoenas issued to banks under F1RREA through Operation Choke Point? 

16. Tn the Supreme Court's recent case in Michigan v. Ray Mills Indian Community , the Court 
made clear that Native Americans “‘going beyond reservation boundaries’ are subject to any 
generally applicable state law”; that the state may “deny a license,” and that if a tribe goes 
forward with unlicensed activities, the state has many powers "to shutter” illegal operations 
“quickly and permanently" illegal operation. The powers the Court cited include injunctions 
and criminal charges against individuals. In light of this ruling, do you think that it is 
inappropriate for a bank or processor that does not want to get caught in a dispute concerning 
tribal lending to avoid providing services to entities that rely on tribal authority to make loans 
to consumers off reservation without complying with state law? 

17. Do you think it is inappropriate for a bank or payment processor to refuse to provide services 
to an entity that purports to be located in the Bahamas, Belize or another foreign country but 
provides services through the internet to consumers in the United State without complying 
with the state and federal laws that apply in those consumers' states? 


o 



